[eslint-refiner] ESLint Refiner — Daily Report 2026-07-01

[github-actions[bot]]

Overview

Today's focus was no-core-setoutput-non-string — the newest rule in eslint-factory and the only one no prior run had reviewed. Filed 3 concrete, non-duplicate refinement issues, and re-verified that yesterday's recorded findings are now resolved.

Key metrics

Metric	Value
Rules in factory	5
Rule reviewed this run	no-core-setoutput-non-string
Issues created	3
Duplicates skipped	0
Prior findings re-verified as fixed	3
Live target sites scanned	~200 core.setOutput calls in actions/setup/js

Refinement tasks filed

1. Unary/negative numeric literals escape detection — core.setOutput("count", 42) is flagged but -1/+5 are not (they parse as UnaryExpression, not Literal). The test suite itself codifies core.setOutput("count", -1) as valid (test:29) — a self-documented inconsistency, since both coerce identically.
2. Misleading autofix for null/undefined — the only suggestion wraps with String(...), producing the literal strings "null"/"undefined" (truthy, non-empty in Actions expressions). This contradicts the rule's own message, which advises ''. Proposed adding an empty-string suggestion.
3. Only .length recognized among numeric members — live false negative at close_entity_helpers.cjs:572, core.setOutput(numberOutputName, closedEntity.number) ships an unwrapped numeric GitHub entity number. Proposed a conservative allowlist extension to .size/.number (keeping .id excluded for FP safety).

Yesterday's findings — all resolved by active refinement

The 2026-06-30 findings were recorded in repo-memory but never actually filed as issues. Re-verified all three against current source — all fixed, so correctly not re-filed:

Verification detail

• require-parseInt-radix — parseInt(x, 0) / undefined / NaN now rejected via isValidSecondArg.
• require-json-parse-try-catch — autofix now emits throw new Error("Failed to parse JSON: "+..., { cause: err }) instead of a useless rethrow.
• no-unsafe-catch-error-property — typeof === 'object' now requires a companion non-null guard; status/cause/name added to the unsafe set.

The codebase refines these rules quickly between daily runs, so each run now re-verifies prior findings before filing.

Next actions

• Triage run: several prior-run issues appear addressed and are close candidates — 41963 (deferred-callback try-ancestry), 42015 (parseInt tests), 42016/42017 (parseInt suggestion/computed), 42188/42190 (catch props/suggestions). Recommend verify-and-close.
• Review no-unsafe-promise-catch-error-property — the only rule never analyzed in depth.
• Mine a 6th recurring defect class in actions/setup/js.

Corpus note: core.setOutput usage is well-disciplined (string literals for booleans, String()/.toString() for counts, JSON.stringify for objects). No live boolean-expression or array/object-literal sites exist, so those coverage gaps were deprioritized in favor of the live/test-grounded findings above.

Generated by 🤖 ESLint Refiner · 216.1 AIC · ⌖ 12.1 AIC · ⊞ 4.7K · ◷

• expires on Jul 1, 2026, 10:53 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by ESLint Refiner.

A newer discussion is available at Discussion #42916.