You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The eslint-factory plugin grew from 12 → 17 rules since the last run (2026-07-08). All 5 new rules were reviewed for the first time today; each was grounded against the live actions/setup/js/** corpus (370 non-test .cjs files). Filed 2 concrete, non-duplicate refinement issues (quality over cap); heavy dedup avoided refiling the already-saturated request rule.
require-return-after-core-setfailed → FILED. Braceless if/else/loop consequents bypass analysis: the rule only scans statement lists (BlockStatement.body, SwitchCase.consequent, Program.body), so if (bad) core.setFailed("x"); doMore(); is never checked — while the braced equivalent is caught. Latent soundness gap (0 live braceless sites; all current sites return immediately). Distinct from the already-fixed callee-form detection (eslint-factory: detect aliased/destructured/computed core.setFailed in require-return-after-core-setfailed #45334).
require-spawnsync-error-check → FILED. (1) Only const <id> = spawnSync() is analyzed, so const { status } = spawnSync() (where .error is unbindable — the worst case) escapes entirely; (2) hasErrorCheck accepts any.error read, including a non-guarding log. Rule otherwise works: real TPs at apply_samples.cjs:97, artifact_client.cjs, send_otlp_span.cjs:823; correct TN at git_helpers.cjs:87 (if (result.error) ... throw).
no-throw-plain-object → no defect. ~23 live throw { code, message } sites (mcp_server_core.cjs, safe_outputs_handlers.cjs) are JSON-RPC error objects; the catch at mcp_server_core.cjs:834 reads only err.code/err.message, so the rule's Object.assign(new Error(msg), { code }) suggestion is behavior-preserving. Genuine, safely-fixable tech-debt — not a false positive. Suggestion support already shipped (feat(eslint-factory): add Object.assign suggestion to no-throw-plain-object rule #45299).
On merge of the two filed issues: verify braced setFailed cases stay unregressed and git_helpers.cjs:87 remains valid while apply_samples.cjs:97 stays flagged.
Watch for an 18th rule (cadence ~1/day) — re-diff index.ts against the tracked inventory next run.
Revisit no-core-exportvariable-non-string consistency once a live non-string arg lands.
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
-
Overview
The
eslint-factoryplugin grew from 12 → 17 rules since the last run (2026-07-08). All 5 new rules were reviewed for the first time today; each was grounded against the liveactions/setup/js/**corpus (370 non-test.cjsfiles). Filed 2 concrete, non-duplicate refinement issues (quality over cap); heavy dedup avoided refiling the already-saturated request rule.Key metrics
index.ts).cjsNew rules — findings
Per-rule verdict (5 new rules)
if/else/loop consequents bypass analysis: the rule only scans statement lists (BlockStatement.body,SwitchCase.consequent,Program.body), soif (bad) core.setFailed("x"); doMore();is never checked — while the braced equivalent is caught. Latent soundness gap (0 live braceless sites; all current sites return immediately). Distinct from the already-fixed callee-form detection (eslint-factory: detect aliased/destructured/computed core.setFailed in require-return-after-core-setfailed #45334).const <id> = spawnSync()is analyzed, soconst { status } = spawnSync()(where.erroris unbindable — the worst case) escapes entirely; (2)hasErrorCheckaccepts any.errorread, including a non-guarding log. Rule otherwise works: real TPs atapply_samples.cjs:97,artifact_client.cjs,send_otlp_span.cjs:823; correct TN atgit_helpers.cjs:87(if (result.error) ... throw).\\$\{ [Content truncated due to length] #45207/Refine interpolated-route diagnostics for opaque Octokit route helpers #45364, grounded atadd_reaction.cjs:193) and scope-resolution FNs (eslint-factory: no-github-request-interpolated-route — scope-resolution false negatives (global.getOctokit client alias + route- [Content truncated due to length] #45206). Rule correctly flags true positives atroute_slash_command.cjs:180-216.throw { code, message }sites (mcp_server_core.cjs,safe_outputs_handlers.cjs) are JSON-RPC error objects; the catch atmcp_server_core.cjs:834reads onlyerr.code/err.message, so the rule'sObject.assign(new Error(msg), { code })suggestion is behavior-preserving. Genuine, safely-fixable tech-debt — not a false positive. Suggestion support already shipped (feat(eslint-factory): add Object.assign suggestion to no-throw-plain-object rule #45299).core.exportVariableargs are strings/templates, so consistency gaps (missesUnaryExpressionnumerics,.size/.byteLength, and object aliases — mirroring setoutput eslint-factory: no-core-setoutput-non-string misses negative/unary numeric literals (e.g. -1, +5) #42680/eslint-factory: no-core-setoutput-non-string only recognizes .length; misses .number/.size (live FN in close_entity_helpers.cjs) #42682) are ungrounded. Will file when a live non-string arg appears.Next actions
setFailedcases stay unregressed andgit_helpers.cjs:87remains valid whileapply_samples.cjs:97stays flagged.index.tsagainst the tracked inventory next run.no-core-exportvariable-non-stringconsistency once a live non-string arg lands.References:
Beta Was this translation helpful? Give feedback.
All reactions