Fix false positives in DependencyPinningAssessor for multi-module, Terraform, and empty repos

docs/attributes.md

@@ -510,9 +510,15 @@ Without a lock file, two installs of the same repo can get different dependency
 
 **Passes if** a recognized lock file is present (score >= 75):
 
-- **Auto-managed lock files** (always fully pinned): `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`, `poetry.lock`, `Pipfile.lock`, `uv.lock`, `Cargo.lock`, `Gemfile.lock`, `go.sum`
+- **Auto-managed lock files** (always fully pinned): `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`, `poetry.lock`, `Pipfile.lock`, `uv.lock`, `Cargo.lock`, `Gemfile.lock`, `go.sum`, `pdm.lock`, `.terraform.lock.hcl`
 - **Manual lock files** (`requirements.txt`): validated for version pinning quality; counts `==` (pinned) vs `>=`/unpinned usage and scores proportionally
 
+**Subdirectory search**: If no lock file exists at the repository root, the assessor searches subdirectories recursively (excluding `vendor/`, `node_modules/`, `.venv/`, `venv/`, `__pycache__/`, `.git/`, and `.terraform/`), so multi-module repos and monorepos with per-package lock files are recognized.
+
+**Terraform fallback**: Repos with no lock files but with `versions.tf` provider constraints are scored on pinning quality: exact pins (`version = "6.0.0"`) count toward a full score, range constraints (`>=`, `<`, `~`, `!=`) score proportionally with a floor of 35 points.
+
+**Not applicable**: Repos with no dependency manifests at all (no `go.mod`, `package.json`, `pyproject.toml`, `Cargo.toml`, `Gemfile`, `requirements.txt`, `Dockerfile`, etc.) return `not_applicable` instead of failing, so documentation-only or config-only repos are not penalized.
+
 **Freshness check**: Lock files older than 6 months incur a 15-point deduction.
 
 **For `requirements.txt`**: The assessor validates version pinning quality by counting lines with `==` (exact pins) versus `>=`, `~=`, or no specifier (unpinned). Score reflects the ratio of pinned to total dependencies.

src/agentready/assessors/stub_assessors.py

@@ -43,6 +43,133 @@ def attribute(self) -> Attribute:
             default_weight=0.05,
         )
 
+    # Directories to exclude from recursive lock file searches
+    _EXCLUDED_DIRS = {
+        "vendor",
+        "node_modules",
+        ".venv",
+        "venv",
+        "__pycache__",
+        ".git",
+        ".terraform",
+    }
+
+    # Package manifests that indicate a repo actually uses dependencies
+    _DEPENDENCY_MANIFESTS = [
+        "go.mod",
+        "package.json",
+        "pyproject.toml",
+        "setup.py",
+        "setup.cfg",
+        "Gemfile",
+        "Cargo.toml",
+        "requirements.txt",
+        "Pipfile",
+        "pom.xml",
+        "build.gradle",
+        "build.gradle.kts",
+        "composer.json",
+        "mix.exs",
+        "pubspec.yaml",
+        "Dockerfile",
+        "Containerfile",
+    ]
+
+    def _rglob_filtered(self, root: Path, filename: str) -> list[Path]:
+        """Recursively search for filename, excluding common non-source dirs."""
+        matches = []
+        for match in root.rglob(filename):
+            if not any(part in self._EXCLUDED_DIRS for part in match.parts):
+                matches.append(match)
+        return matches
+
+    def _has_any_dependency_manifest(self, repository: Repository) -> bool:
+        """Check whether the repo uses any package manager at all."""
+        for manifest in self._DEPENDENCY_MANIFESTS:
+            if (repository.path / manifest).exists():
+                return True
+            if self._rglob_filtered(repository.path, manifest):
+                return True
+        return False
+
+    def _score_terraform_constraints(self, repository: Repository) -> Finding | None:
+        """Score Terraform repos based on versions.tf provider constraints."""
+        import re
+
+        tf_version_files = self._rglob_filtered(repository.path, "versions.tf")
+        tf_lock_files = self._rglob_filtered(repository.path, ".terraform.lock.hcl")
+
+        if not tf_version_files and not tf_lock_files:
+            return None
+
+        if tf_lock_files:
+            rel_paths = [str(p.relative_to(repository.path)) for p in tf_lock_files]
+            return Finding(
+                attribute=self.attribute,
+                status="pass",
+                score=100.0,
+                measured_value=", ".join(rel_paths),
+                threshold="lock file with pinned versions",
+                evidence=[f"Found Terraform lock file(s): {', '.join(rel_paths)}"],
+                remediation=None,
+                error_message=None,
+            )
+
+        pinned = 0
+        ranged = 0
+        for vf in tf_version_files:
+            try:
+                content = vf.read_text()
+                for m in re.finditer(r'version\s*=\s*"([^"]+)"', content):
+                    ver = m.group(1)
+                    if any(op in ver for op in [">", "<", "~", "!="]):
+                        ranged += 1
+                    else:
+                        pinned += 1
+            except OSError:
+                pass
+
+        total = pinned + ranged
+        if total == 0:
+            return None
+
+        score = (pinned / total) * 100 if pinned > 0 else 35.0
+        score = max(score, 35.0)
+        status = "pass" if score >= 75 else "fail"
+
+        return Finding(
+            attribute=self.attribute,
+            status=status,
+            score=score,
+            measured_value=f"{len(tf_version_files)} versions.tf files",
+            threshold="lock file with pinned versions",
+            evidence=[
+                f"Found {len(tf_version_files)} versions.tf file(s) "
+                f"with provider constraints",
+                f"{pinned} exact pins, {ranged} range constraints",
+            ],
+            remediation=(
+                Remediation(
+                    summary="Pin Terraform providers to exact versions",
+                    steps=[
+                        "Run 'terraform providers lock' to generate "
+                        ".terraform.lock.hcl",
+                        "Or pin exact versions in versions.tf "
+                        '(e.g., version = "6.0.0" not ">= 6.0")',
+                    ],
+                    tools=["terraform"],
+                    commands=[
+                        "terraform providers lock " "-platform=linux_amd64",
+                    ],
+                    examples=[],
+                    citations=[],
+                )
+                if status == "fail"
+                else None
+            ),
+            error_message=None,
+        )
+
     def assess(self, repository: Repository) -> Finding:
         """Check for dependency lock files and validate version pinning quality."""
         # Language-specific lock files (auto-managed, always have exact versions)
@@ -57,22 +184,50 @@ def assess(self, repository: Repository) -> Finding:
             "Gemfile.lock",  # Ruby
             "go.sum",  # Go
             "pdm.lock",  # pdm
+            ".terraform.lock.hcl",  # Terraform
         ]
 
         # Manual lock files (need validation)
         manual_lock_files = ["requirements.txt"]  # Python pip
 
+        # 1. Check root-level lock files
         found_strict = [f for f in strict_lock_files if (repository.path / f).exists()]
         found_manual = [f for f in manual_lock_files if (repository.path / f).exists()]
 
-        # Check subdirectories for Go monorepos (go.sum in module dirs)
-        if "go.sum" not in found_strict:
-            for gosum in repository.path.rglob("go.sum"):
-                if "vendor" in gosum.parts:
-                    continue
-                found_strict.append(str(gosum.relative_to(repository.path)))
+        # 2. Recursive fallback for multi-module repos (e.g. Go workspaces,
+        #    monorepos with per-package lock files)
+        if not found_strict:
+            for f in strict_lock_files:
+                matches = self._rglob_filtered(repository.path, f)
+                if matches:
+                    found_strict.extend(
+                        str(m.relative_to(repository.path)) for m in matches
+                    )
 
+        if not found_manual and not found_strict:
+            for f in manual_lock_files:
+                matches = self._rglob_filtered(repository.path, f)
+                if matches:
+                    found_manual.extend(
+                        str(m.relative_to(repository.path)) for m in matches
+                    )
+
+        # 3. If nothing found, check for special ecosystems and edge cases
         if not found_strict and not found_manual:
+            # 3a. Terraform repos: score based on versions.tf constraints
+            tf_finding = self._score_terraform_constraints(repository)
+            if tf_finding is not None:
+                return tf_finding
+
+            # 3b. Repos with no dependency manifests at all → not applicable
+            if not self._has_any_dependency_manifest(repository):
+                return Finding.not_applicable(
+                    self.attribute,
+                    reason="No dependency manifests found "
+                    "(no package manager in use)",
+                )
+
+            # 3c. Has manifests but no lock files → fail
             return Finding(
                 attribute=self.attribute,
                 status="fail",
@@ -83,15 +238,20 @@ def assess(self, repository: Repository) -> Finding:
                 remediation=Remediation(
                     summary="Add lock file for dependency reproducibility",
                     steps=[
-                        "For npm: run 'npm install' (generates package-lock.json)",
-                        "For Python: use 'pip freeze > requirements.txt' or poetry",
-                        "For Ruby: run 'bundle install' (generates Gemfile.lock)",
+                        "For Go: run 'go mod tidy' (generates go.sum)",
+                        "For npm: run 'npm install' " "(generates package-lock.json)",
+                        "For Python: use 'pip freeze > requirements.txt'" " or poetry",
+                        "For Ruby: run 'bundle install' " "(generates Gemfile.lock)",
+                        "For Terraform: run 'terraform providers lock'"
+                        " (generates .terraform.lock.hcl)",
                     ],
-                    tools=["npm", "pip", "poetry", "bundler"],
+                    tools=["go", "npm", "pip", "poetry", "bundler", "terraform"],
                     commands=[
+                        "go mod tidy  # Go",
                         "npm install  # npm",
                         "pip freeze > requirements.txt  # Python",
                         "poetry lock  # Python with Poetry",
+                        "terraform providers lock  # Terraform",
                     ],
                     examples=[],
                     citations=[],