Fix false positives in DependencyPinningAssessor for multi-module, Terraform, and empty repos

src/agentready/assessors/stub_assessors.py

@@ -43,6 +43,121 @@ def attribute(self) -> Attribute:
             default_weight=0.10,
         )
 
+    # Directories to exclude from recursive lock file searches
+    _EXCLUDED_DIRS = {
+        "vendor", "node_modules", ".venv", "venv",
+        "__pycache__", ".git", ".terraform",
+    }
+
+    # Package manifests that indicate a repo actually uses dependencies
+    _DEPENDENCY_MANIFESTS = [
+        "go.mod", "package.json", "pyproject.toml", "setup.py",
+        "setup.cfg", "Gemfile", "Cargo.toml", "requirements.txt",
+        "Pipfile", "pom.xml", "build.gradle", "build.gradle.kts",
+        "composer.json", "mix.exs", "pubspec.yaml",
+        "Dockerfile", "Containerfile",
+    ]
+
+    def _rglob_filtered(self, root: Path, filename: str) -> list[Path]:
+        """Recursively search for filename, excluding common non-source dirs."""
+        matches = []
+        for match in root.rglob(filename):
+            if not any(part in self._EXCLUDED_DIRS for part in match.parts):
+                matches.append(match)
+        return matches
+
+    def _has_any_dependency_manifest(self, repository: Repository) -> bool:
+        """Check whether the repo uses any package manager at all."""
+        for manifest in self._DEPENDENCY_MANIFESTS:
+            if (repository.path / manifest).exists():
+                return True
+            if self._rglob_filtered(repository.path, manifest):
+                return True
+        return False
+
+    def _score_terraform_constraints(self, repository: Repository) -> Finding | None:
+        """Score Terraform repos based on versions.tf provider constraints."""
+        import re
+
+        tf_version_files = self._rglob_filtered(repository.path, "versions.tf")
+        tf_lock_files = self._rglob_filtered(
+            repository.path, ".terraform.lock.hcl"
+        )
+
+        if not tf_version_files and not tf_lock_files:
+            return None
+
+        if tf_lock_files:
+            rel_paths = [
+                str(p.relative_to(repository.path)) for p in tf_lock_files
+            ]
+            return Finding(
+                attribute=self.attribute,
+                status="pass",
+                score=100.0,
+                measured_value=", ".join(rel_paths),
+                threshold="lock file with pinned versions",
+                evidence=[
+                    f"Found Terraform lock file(s): {', '.join(rel_paths)}"
+                ],
+                remediation=None,
+                error_message=None,
+            )
+
+        pinned = 0
+        ranged = 0
+        for vf in tf_version_files:
+            try:
+                content = vf.read_text()
+                for m in re.finditer(
+                    r'version\s*=\s*"([^"]+)"', content
+                ):
+                    ver = m.group(1)
+                    if any(op in ver for op in [">", "<", "~", "!="]):
+                        ranged += 1
+                    else:
+                        pinned += 1
+            except OSError:
+                pass
+
+        total = pinned + ranged
+        if total == 0:
+            return None
+
+        score = (pinned / total) * 100 if pinned > 0 else 35.0
+        score = max(score, 35.0)
+        status = "pass" if score >= 75 else "fail"
+
+        return Finding(
+            attribute=self.attribute,
+            status=status,
+            score=score,
+            measured_value=f"{len(tf_version_files)} versions.tf files",
+            threshold="lock file with pinned versions",
+            evidence=[
+                f"Found {len(tf_version_files)} versions.tf file(s) "
+                f"with provider constraints",
+                f"{pinned} exact pins, {ranged} range constraints",
+            ],
+            remediation=Remediation(
+                summary="Pin Terraform providers to exact versions",
+                steps=[
+                    "Run 'terraform providers lock' to generate "
+                    ".terraform.lock.hcl",
+                    "Or pin exact versions in versions.tf "
+                    '(e.g., version = "6.0.0" not ">= 6.0")',
+                ],
+                tools=["terraform"],
+                commands=[
+                    "terraform providers lock "
+                    "-platform=linux_amd64",
+                ],
+                examples=[],
+                citations=[],
+            ) if status == "fail" else None,
+            error_message=None,
+        )
+
     def assess(self, repository: Repository) -> Finding:
         """Check for dependency lock files and validate version pinning quality."""
         # Language-specific lock files (auto-managed, always have exact versions)
@@ -56,15 +171,58 @@ def assess(self, repository: Repository) -> Finding:
             "Cargo.lock",  # Rust
             "Gemfile.lock",  # Ruby
             "go.sum",  # Go
+            ".terraform.lock.hcl",  # Terraform
         ]
 
         # Manual lock files (need validation)
         manual_lock_files = ["requirements.txt"]  # Python pip
 
-        found_strict = [f for f in strict_lock_files if (repository.path / f).exists()]
-        found_manual = [f for f in manual_lock_files if (repository.path / f).exists()]
+        # 1. Check root-level lock files
+        found_strict = [
+            f for f in strict_lock_files
+            if (repository.path / f).exists()
+        ]
+        found_manual = [
+            f for f in manual_lock_files
+            if (repository.path / f).exists()
+        ]
 
+        # 2. Recursive fallback for multi-module repos (e.g. Go workspaces,
+        #    monorepos with per-package lock files)
+        if not found_strict:
+            for f in strict_lock_files:
+                matches = self._rglob_filtered(repository.path, f)
+                if matches:
+                    found_strict.extend(
+                        str(m.relative_to(repository.path))
+                        for m in matches
+                    )
+
+        if not found_manual and not found_strict:
+            for f in manual_lock_files:
+                matches = self._rglob_filtered(repository.path, f)
+                if matches:
+                    found_manual.extend(
+                        str(m.relative_to(repository.path))
+                        for m in matches
+                    )
+
+        # 3. If nothing found, check for special ecosystems and edge cases
         if not found_strict and not found_manual:
+            # 3a. Terraform repos: score based on versions.tf constraints
+            tf_finding = self._score_terraform_constraints(repository)
+            if tf_finding is not None:
+                return tf_finding
+
+            # 3b. Repos with no dependency manifests at all → not applicable
+            if not self._has_any_dependency_manifest(repository):
+                return Finding.not_applicable(
+                    self.attribute,
+                    reason="No dependency manifests found "
+                    "(no package manager in use)",
+                )
+
+            # 3c. Has manifests but no lock files → fail
             return Finding(
                 attribute=self.attribute,
                 status="fail",
@@ -75,15 +233,24 @@ def assess(self, repository: Repository) -> Finding:
                 remediation=Remediation(
                     summary="Add lock file for dependency reproducibility",
                     steps=[
-                        "For npm: run 'npm install' (generates package-lock.json)",
-                        "For Python: use 'pip freeze > requirements.txt' or poetry",
-                        "For Ruby: run 'bundle install' (generates Gemfile.lock)",
+                        "For Go: run 'go mod tidy' (generates go.sum)",
+                        "For npm: run 'npm install' "
+                        "(generates package-lock.json)",
+                        "For Python: use 'pip freeze > requirements.txt'"
+                        " or poetry",
+                        "For Ruby: run 'bundle install' "
+                        "(generates Gemfile.lock)",
+                        "For Terraform: run 'terraform providers lock'"
+                        " (generates .terraform.lock.hcl)",
                     ],
-                    tools=["npm", "pip", "poetry", "bundler"],
+                    tools=["go", "npm", "pip", "poetry", "bundler",
+                           "terraform"],
                     commands=[
+                        "go mod tidy  # Go",
                         "npm install  # npm",
                         "pip freeze > requirements.txt  # Python",
                         "poetry lock  # Python with Poetry",
+                        "terraform providers lock  # Terraform",
                     ],
                     examples=[],
                     citations=[],