[eslint-refiner] ESLint Refiner — Daily Report — 2026-08-04

[github-actions[bot]]

Summary

Scope: eslint-factory/** custom ESLint rules and their targets in actions/setup/js/**.

Metrics

• Registered custom rules: 38 (up from 12 tracked as of the last detailed run, 2026-07-08 — git history in this checkout is squashed to a single commit, so rule "age" could no longer be dated via git log; pivoted to README documentation-coverage as the freshness proxy).
• Rules reviewed this run: 7 (no-core-error-then-setfailed, no-caught-error-interpolation, no-err-stack-then-string-fallback, no-setfailed-then-exit-zero, prefer-get-error-message-over-string, require-escaped-regexp-interpolation, no-duplicate-constant-values), chosen as the previously-undocumented/never-reviewed set.
• Issues created: 2 (details below).
• Prior open findings re-verified: 2/2 fixed — both issues filed 2026-07-08 against require-fs-sync-try-catch (a destructured/aliased fs binding false-negative, and a catch-less try/finally soundness gap) have since been fixed in try-catch-rule-utils.ts, and the flagged application site (actions/setup/js/action_setup_otlp.cjs:44-49) is now correctly wrapped in try/catch.

Findings

1. README documentation debt (10 of 38 rules undocumented)

Every registered rule builds a doc link of the form .../eslint-factory#<rule-name>, but 10 rules have no matching README section, so that link 404s and contributors have no discoverable rationale for the warning they hit. This gap was flagged as a priority in repo-memory across at least two prior runs (2026-07-08, 2026-07-05) but never actually filed until today.

2. no-duplicate-constant-values: boolean values lack the coincidence guard given to numbers

The rule requires >=3 declarations sharing a numeric value before flagging a "duplicate constant" (MIN_NUMERIC_DUPLICATE_GROUP_SIZE = 3) — an explicit acknowledgment that small numbers collide by coincidence. Booleans get no equivalent guard, despite having only 2 possible values module-wide (a smaller, more collision-prone space than the numeric case the threshold was built for). No live corpus example exists yet — the codebase is disciplined — but this mirrors the precedent set by the ungrounded-but-cheap catch-less try/finally fix filed 2026-07-08, which was accepted and landed.

What didn't pan out

Deep review of require-escaped-regexp-interpolation (a security-relevant ReDoS/regex-injection rule) against ~13 live new RegExp(\...`) interpolation sites in the corpus found the rule behaving correctly throughout, including one already-suppressed true positive (glob_pattern_helpers.cjs:74-75) and several correctly-recognized escapeRegex-style helper true negatives. no-setfailed-then-exit-zero was checked for a hypothesized nested-if` sibling-scope gap; no live vulnerable pattern was found in the corpus. Neither produced a groundable issue this run.

Repo-memory

Updated state.json and history.jsonl on memory/eslint-refiner with this run's findings, the corrected 38-rule count, and the note that git-history-based rule-age detection no longer works in this checkout (squashed history) — future runs should lean on README doc-coverage gaps and the rulesReviewedEver list instead.

Generated by 🤖 ESLint Refiner · agent · 261.5 AIC · ⌖ 30.2 AIC · ⊞ 4.9K · ◷

• expires on Aug 4, 2026, 10:21 PM UTC-08:00

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-08-05T06:21:21.354Z.

Closed by Workflow