Add cop to avoid using create in serializers specs

  - Add tests
  - Enable the cop with a grace period

Fix rubocop

.rubocop.yml

@@ -462,6 +462,12 @@ RSpec/FactoriesInMigrationSpecs:
     - 'spec/lib/ee/gitlab/background_migration/**/*.rb'
     - 'ee/spec/lib/ee/gitlab/background_migration/**/*.rb'
 
+RSpec/FactoryBot/AvoidCreate:
+  Enabled: true
+  Include:
+    - 'spec/serializers/**/*.rb'
+    - 'ee/spec/serializers/**/*.rb'
+
 Cop/IncludeSidekiqWorker:
   Enabled: true
   Exclude:

.rubocop_todo/rspec/factory_bot/avoid_create.yml

+---
+RSpec/FactoryBot/AvoidCreate:
+  Details: grace period
+  Exclude:
+    - 'ee/spec/serializers/analytics/cycle_analytics/stage_entity_spec.rb'
+    - 'ee/spec/serializers/analytics/cycle_analytics/value_stream_errors_serializer_spec.rb'
+    - 'ee/spec/serializers/audit_event_entity_spec.rb'
+    - 'ee/spec/serializers/audit_event_serializer_spec.rb'
+    - 'ee/spec/serializers/blocking_merge_request_entity_spec.rb'
+    - 'ee/spec/serializers/clusters/deployment_entity_spec.rb'
+    - 'ee/spec/serializers/clusters/environment_entity_spec.rb'
+    - 'ee/spec/serializers/clusters/environment_serializer_spec.rb'
+    - 'ee/spec/serializers/dashboard_environment_entity_spec.rb'
+    - 'ee/spec/serializers/dashboard_environments_project_entity_spec.rb'
+    - 'ee/spec/serializers/dashboard_environments_serializer_spec.rb'
+    - 'ee/spec/serializers/dashboard_operations_project_entity_spec.rb'
+    - 'ee/spec/serializers/dependency_entity_spec.rb'
+    - 'ee/spec/serializers/dependency_list_serializer_spec.rb'
+    - 'ee/spec/serializers/ee/blob_entity_spec.rb'
+    - 'ee/spec/serializers/ee/build_details_entity_spec.rb'
+    - 'ee/spec/serializers/ee/ci/job_entity_spec.rb'
+    - 'ee/spec/serializers/ee/deployment_entity_spec.rb'
+    - 'ee/spec/serializers/ee/environment_serializer_spec.rb'
+    - 'ee/spec/serializers/ee/group_child_entity_spec.rb'
+    - 'ee/spec/serializers/ee/issue_board_entity_spec.rb'
+    - 'ee/spec/serializers/ee/issue_entity_spec.rb'
+    - 'ee/spec/serializers/ee/issue_sidebar_basic_entity_spec.rb'
+    - 'ee/spec/serializers/ee/issue_sidebar_extras_entity_spec.rb'
+    - 'ee/spec/serializers/ee/merge_request_poll_cached_widget_entity_spec.rb'
+    - 'ee/spec/serializers/ee/note_entity_spec.rb'
+    - 'ee/spec/serializers/ee/user_serializer_spec.rb'
+    - 'ee/spec/serializers/environment_entity_spec.rb'
+    - 'ee/spec/serializers/epic_entity_spec.rb'
+    - 'ee/spec/serializers/epic_note_entity_spec.rb'
+    - 'ee/spec/serializers/epics/related_epic_entity_spec.rb'
+    - 'ee/spec/serializers/fork_namespace_entity_spec.rb'
+    - 'ee/spec/serializers/geo_project_registry_entity_spec.rb'
+    - 'ee/spec/serializers/incident_management/escalation_policy_entity_spec.rb'
+    - 'ee/spec/serializers/incident_management/oncall_schedule_entity_spec.rb'
+    - 'ee/spec/serializers/integrations/field_entity_spec.rb'
+    - 'ee/spec/serializers/integrations/jira_serializers/issue_detail_entity_spec.rb'
+    - 'ee/spec/serializers/integrations/jira_serializers/issue_entity_spec.rb'
+    - 'ee/spec/serializers/integrations/jira_serializers/issue_serializer_spec.rb'
+    - 'ee/spec/serializers/integrations/zentao_serializers/issue_entity_spec.rb'
+    - 'ee/spec/serializers/issuable_sidebar_extras_entity_spec.rb'
+    - 'ee/spec/serializers/issue_serializer_spec.rb'
+    - 'ee/spec/serializers/issues/linked_issue_feature_flag_entity_spec.rb'
+    - 'ee/spec/serializers/license_compliance/collapsed_comparer_entity_spec.rb'
+    - 'ee/spec/serializers/license_compliance/comparer_entity_spec.rb'
+    - 'ee/spec/serializers/licenses_list_entity_spec.rb'
+    - 'ee/spec/serializers/licenses_list_serializer_spec.rb'
+    - 'ee/spec/serializers/linked_feature_flag_issue_entity_spec.rb'
+    - 'ee/spec/serializers/member_entity_spec.rb'
+    - 'ee/spec/serializers/member_user_entity_spec.rb'
+    - 'ee/spec/serializers/merge_request_poll_widget_entity_spec.rb'
+    - 'ee/spec/serializers/merge_request_sidebar_basic_entity_spec.rb'
+    - 'ee/spec/serializers/merge_request_widget_entity_spec.rb'
+    - 'ee/spec/serializers/pipeline_serializer_spec.rb'
+    - 'ee/spec/serializers/productivity_analytics_merge_request_entity_spec.rb'
+    - 'ee/spec/serializers/project_mirror_entity_spec.rb'
+    - 'ee/spec/serializers/scim_oauth_access_token_entity_spec.rb'
+    - 'ee/spec/serializers/security/vulnerability_report_data_entity_spec.rb'
+    - 'ee/spec/serializers/status_page/incident_comment_entity_spec.rb'
+    - 'ee/spec/serializers/status_page/incident_entity_spec.rb'
+    - 'ee/spec/serializers/status_page/incident_serializer_spec.rb'
+    - 'ee/spec/serializers/vulnerabilities/feedback_entity_spec.rb'
+    - 'ee/spec/serializers/vulnerabilities/finding_entity_spec.rb'
+    - 'ee/spec/serializers/vulnerabilities/finding_reports_comparer_entity_spec.rb'
+    - 'ee/spec/serializers/vulnerabilities/finding_serializer_spec.rb'
+    - 'ee/spec/serializers/vulnerabilities/identifier_entity_spec.rb'
+    - 'ee/spec/serializers/vulnerabilities/request_entity_spec.rb'
+    - 'ee/spec/serializers/vulnerabilities/response_entity_spec.rb'
+    - 'ee/spec/serializers/vulnerabilities/scanner_entity_spec.rb'
+    - 'ee/spec/serializers/vulnerability_entity_spec.rb'
+    - 'ee/spec/serializers/vulnerability_note_entity_spec.rb'
+    - 'spec/serializers/access_token_entity_base_spec.rb'
+    - 'spec/serializers/analytics_build_entity_spec.rb'
+    - 'spec/serializers/analytics_build_serializer_spec.rb'
+    - 'spec/serializers/analytics_issue_entity_spec.rb'
+    - 'spec/serializers/analytics_issue_serializer_spec.rb'
+    - 'spec/serializers/analytics_merge_request_serializer_spec.rb'
+    - 'spec/serializers/analytics_summary_serializer_spec.rb'
+    - 'spec/serializers/base_discussion_entity_spec.rb'
+    - 'spec/serializers/blob_entity_spec.rb'
+    - 'spec/serializers/build_action_entity_spec.rb'
+    - 'spec/serializers/build_artifact_entity_spec.rb'
+    - 'spec/serializers/build_details_entity_spec.rb'
+    - 'spec/serializers/ci/dag_job_entity_spec.rb'
+    - 'spec/serializers/ci/dag_job_group_entity_spec.rb'
+    - 'spec/serializers/ci/dag_pipeline_entity_spec.rb'
+    - 'spec/serializers/ci/dag_pipeline_serializer_spec.rb'
+    - 'spec/serializers/ci/dag_stage_entity_spec.rb'
+    - 'spec/serializers/ci/downloadable_artifact_entity_spec.rb'
+    - 'spec/serializers/ci/downloadable_artifact_serializer_spec.rb'
+    - 'spec/serializers/ci/group_variable_entity_spec.rb'
+    - 'spec/serializers/ci/job_entity_spec.rb'
+    - 'spec/serializers/ci/job_serializer_spec.rb'
+    - 'spec/serializers/ci/lint/result_serializer_spec.rb'
+    - 'spec/serializers/ci/pipeline_entity_spec.rb'
+    - 'spec/serializers/ci/trigger_entity_spec.rb'
+    - 'spec/serializers/ci/variable_entity_spec.rb'
+    - 'spec/serializers/cluster_application_entity_spec.rb'
+    - 'spec/serializers/cluster_entity_spec.rb'
+    - 'spec/serializers/cluster_serializer_spec.rb'
+    - 'spec/serializers/clusters/kubernetes_error_entity_spec.rb'
+    - 'spec/serializers/commit_entity_spec.rb'
+    - 'spec/serializers/container_repositories_serializer_spec.rb'
+    - 'spec/serializers/container_repository_entity_spec.rb'
+    - 'spec/serializers/container_tag_entity_spec.rb'
+    - 'spec/serializers/context_commits_diff_entity_spec.rb'
+    - 'spec/serializers/deploy_keys/basic_deploy_key_entity_spec.rb'
+    - 'spec/serializers/deploy_keys/deploy_key_entity_spec.rb'
+    - 'spec/serializers/deployment_cluster_entity_spec.rb'
+    - 'spec/serializers/deployment_entity_spec.rb'
+    - 'spec/serializers/deployment_serializer_spec.rb'
+    - 'spec/serializers/diff_file_base_entity_spec.rb'
+    - 'spec/serializers/diff_file_entity_spec.rb'
+    - 'spec/serializers/diff_file_metadata_entity_spec.rb'
+    - 'spec/serializers/diff_viewer_entity_spec.rb'
+    - 'spec/serializers/diffs_entity_spec.rb'
+    - 'spec/serializers/diffs_metadata_entity_spec.rb'
+    - 'spec/serializers/discussion_diff_file_entity_spec.rb'
+    - 'spec/serializers/discussion_entity_spec.rb'
+    - 'spec/serializers/environment_entity_spec.rb'
+    - 'spec/serializers/environment_serializer_spec.rb'
+    - 'spec/serializers/environment_status_entity_spec.rb'
+    - 'spec/serializers/evidences/evidence_entity_spec.rb'
+    - 'spec/serializers/evidences/release_entity_spec.rb'
+    - 'spec/serializers/feature_flag_entity_spec.rb'
+    - 'spec/serializers/feature_flag_serializer_spec.rb'
+    - 'spec/serializers/feature_flag_summary_entity_spec.rb'
+    - 'spec/serializers/feature_flag_summary_serializer_spec.rb'
+    - 'spec/serializers/feature_flags_client_serializer_spec.rb'
+    - 'spec/serializers/fork_namespace_entity_spec.rb'
+    - 'spec/serializers/group_access_token_entity_spec.rb'
+    - 'spec/serializers/group_access_token_serializer_spec.rb'
+    - 'spec/serializers/group_child_entity_spec.rb'
+    - 'spec/serializers/group_child_serializer_spec.rb'
+    - 'spec/serializers/group_deploy_key_entity_spec.rb'
+    - 'spec/serializers/group_link/group_group_link_entity_spec.rb'
+    - 'spec/serializers/group_link/project_group_link_entity_spec.rb'
+    - 'spec/serializers/group_link/project_group_link_serializer_spec.rb'
+    - 'spec/serializers/impersonation_access_token_entity_spec.rb'
+    - 'spec/serializers/impersonation_access_token_serializer_spec.rb'
+    - 'spec/serializers/import/manifest_provider_repo_entity_spec.rb'
+    - 'spec/serializers/integrations/event_entity_spec.rb'
+    - 'spec/serializers/integrations/field_entity_spec.rb'
+    - 'spec/serializers/integrations/harbor_serializers/artifact_entity_spec.rb'
+    - 'spec/serializers/integrations/harbor_serializers/repository_entity_spec.rb'
+    - 'spec/serializers/integrations/harbor_serializers/tag_entity_spec.rb'
+    - 'spec/serializers/integrations/project_entity_spec.rb'
+    - 'spec/serializers/issuable_sidebar_extras_entity_spec.rb'
+    - 'spec/serializers/issue_board_entity_spec.rb'
+    - 'spec/serializers/issue_entity_spec.rb'
+    - 'spec/serializers/issue_serializer_spec.rb'
+    - 'spec/serializers/issue_sidebar_basic_entity_spec.rb'
+    - 'spec/serializers/jira_connect/app_data_serializer_spec.rb'
+    - 'spec/serializers/jira_connect/group_entity_spec.rb'
+    - 'spec/serializers/jira_connect/subscription_entity_spec.rb'
+    - 'spec/serializers/job_artifact_report_entity_spec.rb'
+    - 'spec/serializers/label_serializer_spec.rb'
+    - 'spec/serializers/lfs_file_lock_entity_spec.rb'
+    - 'spec/serializers/linked_project_issue_entity_spec.rb'
+    - 'spec/serializers/member_entity_spec.rb'
+    - 'spec/serializers/member_serializer_spec.rb'
+    - 'spec/serializers/member_user_entity_spec.rb'
+    - 'spec/serializers/merge_request_current_user_entity_spec.rb'
+    - 'spec/serializers/merge_request_diff_entity_spec.rb'
+    - 'spec/serializers/merge_request_for_pipeline_entity_spec.rb'
+    - 'spec/serializers/merge_request_metrics_helper_spec.rb'
+    - 'spec/serializers/merge_request_poll_cached_widget_entity_spec.rb'
+    - 'spec/serializers/merge_request_poll_widget_entity_spec.rb'
+    - 'spec/serializers/merge_request_serializer_spec.rb'
+    - 'spec/serializers/merge_request_sidebar_basic_entity_spec.rb'
+    - 'spec/serializers/merge_request_sidebar_extras_entity_spec.rb'
+    - 'spec/serializers/merge_request_user_entity_spec.rb'
+    - 'spec/serializers/merge_request_widget_commit_entity_spec.rb'
+    - 'spec/serializers/merge_request_widget_entity_spec.rb'
+    - 'spec/serializers/merge_requests/pipeline_entity_spec.rb'
+    - 'spec/serializers/namespace_basic_entity_spec.rb'
+    - 'spec/serializers/note_entity_spec.rb'
+    - 'spec/serializers/paginated_diff_entity_spec.rb'
+    - 'spec/serializers/personal_access_token_entity_spec.rb'
+    - 'spec/serializers/personal_access_token_serializer_spec.rb'
+    - 'spec/serializers/pipeline_details_entity_spec.rb'
+    - 'spec/serializers/pipeline_serializer_spec.rb'
+    - 'spec/serializers/project_access_token_entity_spec.rb'
+    - 'spec/serializers/project_access_token_serializer_spec.rb'
+    - 'spec/serializers/project_import_entity_spec.rb'
+    - 'spec/serializers/project_mirror_entity_spec.rb'
+    - 'spec/serializers/project_note_entity_spec.rb'
+    - 'spec/serializers/project_serializer_spec.rb'
+    - 'spec/serializers/prometheus_alert_entity_spec.rb'
+    - 'spec/serializers/release_serializer_spec.rb'
+    - 'spec/serializers/remote_mirror_entity_spec.rb'
+    - 'spec/serializers/review_app_setup_entity_spec.rb'
+    - 'spec/serializers/runner_entity_spec.rb'
+    - 'spec/serializers/serverless/domain_entity_spec.rb'
+    - 'spec/serializers/stage_entity_spec.rb'
+    - 'spec/serializers/stage_serializer_spec.rb'
+    - 'spec/serializers/suggestion_entity_spec.rb'
+    - 'spec/serializers/test_case_entity_spec.rb'
+    - 'spec/serializers/test_report_entity_spec.rb'
+    - 'spec/serializers/test_report_summary_entity_spec.rb'
+    - 'spec/serializers/test_suite_entity_spec.rb'
+    - 'spec/serializers/test_suite_summary_entity_spec.rb'
+    - 'spec/serializers/trigger_variable_entity_spec.rb'
+    - 'spec/serializers/user_entity_spec.rb'
+    - 'spec/serializers/user_serializer_spec.rb'
+    - 'spec/serializers/web_ide_terminal_entity_spec.rb'
+    - 'spec/serializers/web_ide_terminal_serializer_spec.rb'

rubocop/cop/rspec/factory_bot/avoid_create.rb

+# frozen_string_literal: true
+
+require 'rubocop-rspec'
+
+module RuboCop
+  module Cop
+    module RSpec
+      module FactoryBot
+        # This cop checks for the creation of ActiveRecord objects in serializers specs specs
+        #
+        # @example
+        #
+        #   # bad
+        #   let(:user) { create(:user) }
+        #   let(:users) { create_list(:user, 2) }
+        #
+        #   # good
+        #   let(:user) { build_stubbed(:user) }
+        #   let(:user) { build(:user) }
+        #   let(:users) { build_stubbed_list(:user, 2) }
+        #   let(:users) { build_list(:user, 2) }
+        class AvoidCreate < RuboCop::Cop::Base
+          MESSAGE = "Prefer using `build_stubbed` or similar over `%{method_name}`. See https://docs.gitlab.com/ee/development/testing_guide/best_practices.html#optimize-factory-usage"
+          FORBIDDEN_METHODS = %i[create create_list].freeze
+          RESTRICT_ON_SEND = FORBIDDEN_METHODS
+
+          def_node_matcher :forbidden_factory_usage, <<~PATTERN
+            (
+              send
+              {(const nil? :FactoryBot) nil?}
+              ${ #{FORBIDDEN_METHODS.map(&:inspect).join(' ')} }
+              ...
+              )
+          PATTERN
+
+          def on_send(node)
+            method_name = forbidden_factory_usage(node)
+            return unless method_name
+
+            add_offense(node, message: format(MESSAGE, method_name: method_name))
+          end
+        end
+      end
+    end
+  end
+end

spec/rubocop/cop/rspec/factory_bot/avoid_create_spec.rb

+# frozen_string_literal: true
+
+require 'rubocop_spec_helper'
+
+require_relative '../../../../../rubocop/cop/rspec/factory_bot/avoid_create'
+
+RSpec.describe RuboCop::Cop::RSpec::FactoryBot::AvoidCreate do
+  shared_examples 'an offensive factory call' do |namespace|
+    %i[create create_list].each do |forbidden_method|
+      namespaced_forbidden_method = "#{namespace}#{forbidden_method}(:user)"
+
+      it "registers an offense for #{namespaced_forbidden_method}" do
+        expect_offense(<<-RUBY)
+        describe 'foo' do
+          let(:user) { #{namespaced_forbidden_method} }
+                       #{'^' * namespaced_forbidden_method.size} Prefer using `build_stubbed` or similar over `#{forbidden_method}`. See https://docs.gitlab.com/ee/development/testing_guide/best_practices.html#optimize-factory-usage
+        end
+        RUBY
+      end
+    end
+  end
+
+  it_behaves_like 'an offensive factory call', ''
+  it_behaves_like 'an offensive factory call', 'FactoryBot.'
+end