[eslint-refiner] ESLint Refiner — 2026-07-10: no-github-request-interpolated-route verified precise; gaps already tracked

[github-actions[bot]]

Overview

Today's review focused on no-github-request-interpolated-route — the newest (13th) rule and, per my strategy, the one to lead with. A correction up front: my persisted strategy notes were stale (dated 2026-07-08, tracking only 12 rules). A run I hadn't recorded (run §28998707309) already reviewed this rule on 2026-07-09 and filed comprehensive follow-ups. I cross-checked GitHub (open and closed issues) to avoid duplicating that work, and have refreshed repo-memory accordingly.

Outcome: rule verified sound and precise; 0 new issues filed — every meaningful, grounded gap is already tracked in #44515 (open) or shipped in #44550 (merged). Duplicates explicitly skipped. Lower-priority candidate refinements are surfaced below for maintainer input rather than filed unilaterally on a rule that was just reviewed.

Key metrics

Metric	Value
Rules registered (index.ts)	13
Rule reviewed this run	no-github-request-interpolated-route
Live true positives it catches	6 (across 3 files)
Live false positives	0
New issues filed	0 (explicit duplicate-skip)
Open eslint-factory issues	2 (#44515, #43948)

Rule health — no-github-request-interpolated-route

The rule is precise on live code. It flags full-path interpolation and non-constant + concatenation of the route argument for the four known Octokit client names, and correctly ignores safe forms.

Grounded true positives (rule working as intended)

• route_slash_command.cjs:180 / 192 / 204 / 216 — `POST /repos/${owner}/${repo}/issues/${issueNumber}/reactions` and siblings interpolate real values into the path.
• add_reaction.cjs:193 and add_reaction_and_edit_comment.cjs:266 — `POST ${endpoint}` where endpoint resolves to an interpolated path.
• add_workflow_run_comment.cjs:444 — "POST " + endpoint, where endpoint is `/repos/${owner}/${repo}/issues/${number}/comments`.

All six are genuine value-into-route bypasses — the rule is surfacing real anti-patterns, not noise.

Correctly-unflagged forms (0 false positives)

• update_project.cjs:877 and create_project.cjs:252 — github.request(route, params) where route is a safe literal ternary using typed placeholders.
• update_activation_comment.cjs:211 — fallbackClient.request("POST /repos/{owner}/{repo}/...") — off-list client, static route.
• Node core http.request / https.request (validate_secrets.cjs, mcp_cli_bridge.cjs, mount_mcp_as_cli.cjs) — correctly out of scope.

Already tracked — not re-filed

• #44515 (open): the two false-negative gaps — client detection limited to a 4-name allow-list (misses aliased/off-list clients such as fallbackClient = options.targetGithubClient || github at update_activation_comment.cjs:206) and variable-indirection routes. Its acceptance criteria already ask for scope-aware resolution while keeping http/https excluded. Comprehensive; skipped as duplicate.
• #44550 (merged 2026-07-09): pinned the rule's boundary behavior in tests, narrowed the constant-only + concatenation false positive (the isStaticRouteExpression helper), and documented all 13 rules in the README — which also resolves the long-standing "README documents only a subset of rules" doc debt.

Candidate refinements (surfaced, not filed)

These are lower-priority and overlap with just-shipped work, so I'm raising them here for maintainer input instead of filing on a freshly-reviewed rule:

1. Remediation actionability (weak diagnostic). Unlike sibling rules (no-json-stringify-error, require-fs-sync-try-catch) the route rule offers no suggestion, and its message doesn't name the offending ${...} segments. A correct autofix is genuinely hard here — each of the 6 live sites already passes a params object, and ${issueNumber} → issue_number param-key extraction isn't mechanical — so this is a design decision (enrich the message vs. add a narrowly-scoped suggestion), not a mechanical fix.
2. const-bound placeholder concatenation. #44550 narrowed the literal-only concat FP, but "POST " + PATH_CONST where PATH_CONST holds a placeholder path is still flagged. This is ungrounded today and would be resolved naturally by the scope resolution #44515 already proposes — best folded there.
3. TaggedTemplateExpression bypass (minor). isInterpolatedTemplateLiteral only inspects TemplateLiteral, so a tagged template route would slip through. Cheap to close but exotic/ungrounded — noted for completeness.

Adjacent verification

While confirming the broader rule set is healthy, I verified prefer-number-isnan is fully fixed (prior #43486): hasLocalBinding now recognizes any local definition including ESM ImportBinding (variable.defs.length > 0), and the coercion caveat is carried in the suggestion message.

Next actions

• No maintainer action required beyond the existing #44515 / #43948.
• Future runs: watch index.ts for a 14th rule; if none appears, re-verify a recently-closed rule from current source for incomplete/regressed fixes.

References:

• eslint-factory: no-github-request-interpolated-route detects clients by 4 hard-coded names only — off-list Octokit clients and h [Content truncated due to length] #44515
• Document and pin no-github-request-interpolated-route boundary behavior #44550
• https://github.com/github/gh-aw/actions/runs/28998707309

Generated by 🤖 ESLint Refiner · 249.3 AIC · ⌖ 11.4 AIC · ⊞ 4.6K · ◷

• expires on Jul 10, 2026, 10:41 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by ESLint Refiner.

A newer discussion is available at Discussion #44880.