[eslint-refiner] ESLint Refiner — Daily Report 2026-07-23

[github-actions[bot]]

Overview

Daily rule-quality pass over eslint-factory (27 custom rules) against actions/setup/js (751 .cjs targets). Focus: false negatives, weak diagnostics, and missing edge cases in the interpolation- and error-handling rule families. 3 concrete refinement tasks filed, all grounded in rule source + real target code, all non-duplicate.

Key metrics

Metric	Value
Custom rules reviewed	27
Target files in scope (actions/setup/js/**.cjs)	751
Refinement issues filed	3
Duplicates skipped	0 (checked against #46992-#46994, #47211-#47212, #47412-#47413)
Live-lint diagnostics	not run — deps/network unavailable this run (static analysis used instead)
Repo-memory persisted	⚠️ blocked (see limitations)

Refinement tasks filed

1. New rule — no-child-process-interpolated-command (shell-injection coverage). no-exec-interpolated-command only covers the @actions/exec global (arg-splitting). Node's child_process.execSync/exec/spawn run through a shell → interpolated command strings are a shell-injection vector nothing currently catches. Demand is proven: push_repo_memory.test.cjs:1155-1165 hand-rolls a regex to forbid execSync(\git ${var}`), and start_mcp_gateway.cjshas real interpolatedexecSync` calls.
2. no-exec-interpolated-command — single-level variable-indirection false negative. The rule inspects only arguments[0]'s syntactic shape; assigning the command to a variable first evades it (documented out-of-scope at no-exec-interpolated-command.test.ts:22-23). Real code builds command strings in variables (create_pull_request.test.cjs:3064).
3. no-unsafe-catch-error-property — flow-insensitive guard. A single frame-level hasGuard flag lets a guard on one branch (or textually after the access) suppress an unguarded access on another branch → false negatives.

Analysis detail & method

• Reviewed shared helpers (try-catch-rule-utils.ts) and the interpolation/error-handling rule sources directly; the codebase already exposes child_process binding resolvers (isRequireChildProcess, isChildProcessImportBinding, isChildProcessObjectBinding), so task rejig docs #1 can reuse them.
• Confirmed no-exec-interpolated-command correctly flags the direct exec.exec(\git ${x}`, [])shape — many real occurrences remain inpush_to_pull_request_branch.cjs/create_pull_request.cjs`, pending eslint-monster code fixes ([eslint-monster] setup/js lint stream 2: wrap sync fs and sync exec I/O in try/catch #47412/[eslint-monster] setup/js lint stream 3: standardize failure signaling and unsafe coercion patterns #47413). Those are code-fix streams, not rule defects, so they were not re-filed.
• Dedup baseline: prior refiner issues eslint-factory: require-return-after-core-setfailed misses bare switch-case fall-through (FN) and flags trailing function declar [Content truncated due to length] #46992-eslint-factory: prefer-core-logging offers an unsafe autofix for non-string console.* arguments #46994 and [eslint-factory] Cover execFileSync in require-execsync-try-catch (throwing child_process sync sibling) #47211-[eslint-factory] no-core-error-then-process-exitcode: match sibling's non-adjacent forward scan (+ top-level autofix) #47212 are all CLOSED and target different rules/concerns; open eslint issues [eslint-monster] setup/js lint stream 2: wrap sync fs and sync exec I/O in try/catch #47412/[eslint-monster] setup/js lint stream 3: standardize failure signaling and unsafe coercion patterns #47413 are code-fix streams. No overlap.

Limitations this run

• Repo-memory not persisted. The /tmp/gh-aw/repo-memory/default/ path is blocked at the tool layer in this session (both read and write), so no strategy/state snapshot could be written or validated via push_repo_memory. Continuity notes for the next run are captured in this discussion instead: next candidates to evaluate are (a) no-json-stringify-error nested-in-object coverage (JSON.stringify({ error: err })), and (b) adding safe suggestions to no-exec-interpolated-command for simple space-delimited commands.
• No live lint run. eslint-factory dev deps are not installed and network install was unavailable; findings are from static source review, which is sufficient for rule-quality gaps.

Next actions

• Triage the 3 filed issues; task rejig docs #1 is security-relevant and highest priority.
• Restore repo-memory access so strategy/state can persist across runs.

References:

• §29984133883

Generated by 🤖 ESLint Refiner · age00 317.3 AIC · ⌖ 13.1 AIC · ⊞ 4.6K · ◷

• expires on Jul 23, 2026, 10:20 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by ESLint Refiner.

A newer discussion is available at Discussion #47734.