Merge pull request #11 from Hypercart-Dev-Tools/rules/time-false-positive

fix: Exclude gmdate() from timezone-sensitive pattern detection to Development

Author: noelsaw1

CHANGELOG.md

@@ -8,6 +8,21 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [1.0.59] - 2025-12-31
 
 ### Fixed
+- **Timezone-Sensitive Pattern False Positive** - Fixed detection to exclude `gmdate()` (timezone-safe function)
+  - **Issue:** Pattern was flagging `gmdate()` as timezone-sensitive, but `gmdate()` always returns UTC (timezone-safe)
+  - **Root Cause:** Pattern matched any function containing "date" without distinguishing between `date()` and `gmdate()`
+  - **Fix:** Updated pattern to use `grep -v "gmdate"` to exclude timezone-safe `gmdate()` calls
+  - **Impact:** Reduces false positives - only flags `date()` (timezone-dependent) and `current_time('timestamp')`
+  - **Location:** Lines 2071-2082 in check-performance.sh
+  - **Rationale:**
+    - `date()` - Uses PHP's configured timezone (can vary by server) - **SHOULD BE FLAGGED**
+    - `gmdate()` - Always returns UTC/GMT (consistent across environments) - **SHOULD NOT BE FLAGGED**
+    - WordPress stores all dates internally as UTC, so `gmdate()` is the recommended approach
+  - **Testing:** Verified with test file containing both `date()` and `gmdate()` calls
+    - ✅ `date('Y-m-d')` - Correctly flagged
+    - ✅ `gmdate('Y-m-d')` - Correctly NOT flagged
+    - ✅ `current_time('timestamp')` - Correctly flagged
+
 - **Version Drift Bug** - Created single source of truth for version number to prevent version inconsistencies
   - **Issue:** Script had 4 different hardcoded version strings that were out of sync (header: 1.0.59, banner/logs/JSON: 1.0.58)
   - **Root Cause:** Version number was hardcoded in 4 different locations instead of using a single variable

dist/bin/check-performance.sh

@@ -2069,13 +2069,17 @@ text_echo "${YELLOW}━━━ WARNING CHECKS (review recommended) ━━━${NC}
 text_echo ""
 
 # Enhanced timezone check - skip lines with phpcs:ignore comments
+# Note: Only flags date() (timezone-dependent), not gmdate() (timezone-safe, always UTC)
 text_echo "${BLUE}▸ Timezone-sensitive patterns (current_time/date) ${YELLOW}[LOW]${NC}"
 TZ_WARNINGS=0
 TZ_FINDING_COUNT=0
 TZ_MATCHES=$(grep -rHn $EXCLUDE_ARGS --include="*.php" \
-  -e "current_time[[:space:]]*([[:space:]]*['\"]timestamp" \
-  -e "date[[:space:]]*([[:space:]]*['\"][YmdHis-]*['\"]" \
+  -E "current_time[[:space:]]*\([[:space:]]*['\"]timestamp" \
   $PATHS 2>/dev/null || true)
+# Add date() matches but exclude gmdate() (which is timezone-safe, always UTC)
+TZ_MATCHES="${TZ_MATCHES}"$'\n'$(grep -rHn $EXCLUDE_ARGS --include="*.php" \
+  -E "[^a-zA-Z_]date[[:space:]]*\(" \
+  $PATHS 2>/dev/null | grep -v "gmdate" || true)
 
 if [ -n "$TZ_MATCHES" ]; then
   # Filter out lines that have phpcs:ignore nearby (check line before)