false positives for hook sniffing

I've not looked at the code for this module, but the way to ccover for this would be to grab the module's root name from its filename or the system table and search for ROOTNAME_HOOKNAME. Then you're covered for that.
I wrote some hooksniffing regexps for module_builder which you might want to look at :)

So having had a chat about this on IRC, I see the current code says this:

      array(
        '#type' => 'regex',
        '#value' => 'function\s+[a-z0-9_]+_(access)\s*\(',
        '#function-not' => '^\w+_node_access$',
        '#warning_callback' => '_coder_review_7x_hook_access_warning',
      ),

It seems to me we could abstract some of this.
Otherwise, every single data key in hook_reviews that looks for a hook is reimplementing the same regexp, bar a hook name.

So instead:

      array(
        '#type' => 'hook',
        '#value' => 'access',
        '#function-not' => '^\w+_node_access$',
        '#warning_callback' => '_coder_review_7x_hook_access_warning',
      ),

Whatever uses hook_review then has to build a regexp like:

'function\s+$modulerootname_$hookname\s*\('

Patch is good.
But was missing any actual implementation to try it.
So I have changed the hook_access check to use this new thingy instead, and run trackerlite through a coder review.

Success:
function _trackerlite_myrecent_access($account) {
not picked up.
Added this to my code
funtion trackerlite_access() {
and this IS picked up.

Here's an updated patch.

I think however this needs some documentation on how to use it in a hook_reviews file.
In particular, it's important to say whether you need to give the #value as 'access' (which is the case) or 'hook_access' (which isn't, but one could suppose it is).
However, the place for this says:
// @TODO : document hook_reviews()
so that's another issue really -- #598600: // @TODO : document hook_reviews() in fact. We can't add to documentation that doesn't exist at all yet.

Hmmm that shouldn't happen, as it's using the module name to build the hook name.

Can you check what it's building in your case with this line:

    $hook = array('#value' => ' ' . $module_name . '_' . $rule['#value'] . '(');

That line is in the patch.

Sorry; my mistake, I completely misread your earlier comment :/ -- I thought you meant you were getting false positives even with the patch. Doh!

I haven't time to reroll this at the moment, but it's not a very big patch, so unless things have changed massively shouldn't be too much work :)