Enable support for importing/inheriting Rubocop configurations

[bkuhlmann]

Rubocop supports inheritance from a remote URL. It'd be helpful if this could be supported via Code Climate without hitting an HTTP error so that a global configuration could be used for multiple projects within teams (especially large teams). This was mentioned in Issue 39 and would be great to resolve.

[ljones140]

I am also having the same issue. We use a global rubocop configuration which we have put into a gem that we then require to our projects by using rubocops inherit_gem: directive

[pbrisbin]

Sorry for the delayed response here. Unfortunately, our engines run in a restricted environment with no network access. We realize this is a severe limitation, but the security concerns with running 3rd-party engines over customer source code are more important to us.

Until we're able to open up network access in a way we're completely comfortable with, we won't be able to support use cases like this. It's definitely something we want to do, but unfortunately we can't offer any kind of timeline right now.

[pbrisbin]

I've opened an issue at qltysh/qlty#480 to track this limitation. I'm going to go ahead and close this one.

[bkuhlmann]

Sounds good, thanks for doing this.

[Jonic]

I wanted to come along and +1 the issue stopping Rubocop from using an inherits_from value, but this issue has been closed, and the conversation on qltysh/qlty#480 has been locked - is this still being looked at? Would be really useful to have!

[maxjacobson]

Hey @Jonic --

Yep, happy to share that there has been movement on this. We recently introduced support for external configuration: https://codeclimate.com/changelog/582495c32c33066f1b00191d

We should probably update that centralized issue with this development.

[Jonic]

Thanks for that @maxjacobson - that did the trick for us :)

[maxjacobson]

@Jonic glad to hear it. I posted an update on that centralized issue so more people will stumble upon it. Thanks for reminding us about that.

[kyprifog]

Whats the best practice for when this rubocop config is located in a private git repo? I can think of a couple of ways around it but both seem somewhat inconvenient.

[pbrisbin]

Hi @kyprifog,

In general, we have found that moving these kind of shared configurations to a dedicated "style guide" repo that is public works well for most people. If the file must be private, you can use a URL that includes ?access_token= with a token that grants access to that file (assuming GitHub here).

It is definitely a security concern to commit such a token in your actual project repo, which can be mitigated by restricting the token's permissions. How strict the permissions on that token are is the trade off between security and convenience. The most secure approach would be a token belonging to a dedicated user with read-only access to only the repository containing this file. (I don't think you can set an access limitation like this on a token for a user who themselves has broader access.)

Hope this helps.