RuboCop does not merge Exclude by default and therefore scans vendor/bundle

[eregon]

RuboCop currently does not merge Exclude by default.
I think this is a significant usability bug, because it makes RuboCop harder to use in combination with the very common Bundler path vendor/bundle.

Notably, it causes extra troubles for ruby/setup-ruby in ruby/setup-ruby#136 and RuboCop seems by far the most common tool to be tripped up by files under vendor/. Other tools seem to deal with it just fine by default, or be much less frequently used.

So that even though RuboCop does exclude vendor/**/* in the default config,
that has actually no effect at all (!) when using a .rubocop.yml such as:

AllCops:
  Exclude:
    - 'gemfiles/**/*'

---

Expected behavior

RuboCop should by default ignore vendor/**/*, even if the config defines extra AllCops: -> Exclude:.

Actual behavior

An extra AllCops: -> Exclude: overrides the default, which I believe is always unintentional.
This results in confusing errors, for instance when seeing an old TargetRubyVersion from a gem under vendor/bundle, such as:

$ bundle exec rubocop
Error: Unsupported Ruby version 2.1 found in `TargetRubyVersion` parameter (in vendor/bundle/ruby/2.5.0/gems/rainbow-3.0.0/.rubocop.yml). 2.1-compatible analysis was dropped after version 0.58.
Supported versions: 2.2, 2.3, 2.4, 2.5, 2.6

If it does not error, it would also slow down RuboCop significantly by scanning all these extra files.

This problem will also cause .git, node_modules and tmp to be scanned, while they should not.

Workaround

inherit_mode:
  merge:
    - Exclude

(https://docs.rubocop.org/rubocop/0.88/configuration.html#merging-arrays-using-inherit_mode)

I don't think it's a good workaround. RuboCop should work fine with the most used Bundler path without any extra manual step.
It is confusing that the default Exclude paths are completely forgotten whenever adding a custom Exclude.

Related: #288 (comment) #7819 and I guess other issues, this is counter-intuitive and confusing behavior.

[marcandre]

Agreed.

Is there any use case where that could be problematic? (Asking @bbatsov, @koic and others that have more experience with config and uses)

[jonas054]

The default list of excludes is small and only contains directories that are hard to imagine anyone would want to inspect.

So merging by default makes a lot of sense. The only potential problem I can foresee is that users who were overriding AllCops: Exclude and actually wanted to inspect files under tmp/ for example, would get those files excluded. Should be very rare.

[januszm]

With more and more projects migrating to Github Actions, this will be a growing problem (In GH Actions gems install to vendor/bundle, that's how I found this PR)

[eregon]

Ping, it seems many people are hitting this when using GitHub Actions, it would be great if this was fixed in RuboCop.

[bbatsov]

See #9624.

[maxveldink]

I'm catching up on the conversation and late to the party here, but this is a great change I'd love to see merged. This issue has bit me three or four times in the last few months as I've been setting up CI for a few projects, and it's very frustrating when you hit the first instance where you need to Exclude a path, and suddenly CI begins failing for a seemingly unrelated issue.

I understand the implication of changing the default configuration behavior here; in the short term, perhaps figuring out how to warn about the behavior if the Exclude option is detected in the configuration would be a helpful addition. Also, add a way to suppress the warning as well?

Open to feedback here, but having something give me a clue that I'm overriding a pretty important default (as far as CI is concerned) would be nice!