[eslint-refiner] ESLint Refiner Daily Report - 2026-08-19

[github-actions[bot]]

ESLint Refiner — Daily Report (2026-08-19)

Scope: eslint-factory/** custom rules targeting actions/setup/js/**.

This run followed a 6-week gap since the last recorded run (2026-07-08). In that time the rule inventory grew from 12 to 51 rules, and gh search revealed the two/three rules reviewed today had already been through 15+ prior refinement rounds not reflected in this workflow's persisted memory — a reminder that repo-memory history is a lower bound on prior work, not the full record. All previously-open issues tracked in memory (9 total, from 2026-06-27 through 2026-07-08) are now closed/fixed.

Key metrics

Metric	Value
Total custom rules	51 (up from 12)
Rules reviewed this run	3
Issues filed	2
Duplicates skipped	0 (both confirmed novel via gh api search/issues)
Prior tracked issues re-verified	9/9 closed

Strategy shift

The repo is a shallow git clone (1 commit visible), so the old "diff index.ts imports to find the newest rule" heuristic is dead — there's no date signal to rank by. This run switched to severity-based prioritization: review unreviewed rules that guard against injection/RCE-class defects first. That pointed at the three sibling rules sharing command-initializer-utils.ts: no-child-process-interpolated-command, no-exec-interpolated-command, and no-github-request-interpolated-route.

Issues filed

1. resolveInitializer mishandles destructured bindings (high severity, cross-rule) — the shared initializer-resolution helper in command-initializer-utils.ts returns the whole right-hand-side expression for const [x] = arr / const {x} = obj bindings instead of treating them as unresolved, same class of bug the sibling isChildProcessObjectBinding helper already guards against elsewhere in the same rule family. A single fix corrects all three consuming rules. Grounded: the exact destructure-into-exec-arg shape already exists live in create_labels.cjs:46.
2. no-exec-interpolated-command has zero coverage for the execApi parameter-alias pattern (medium-high severity) — the rule only matches the literal identifier exec, but the dominant calling convention in the two largest git-mutation scripts (git_helpers.cjs, 20+ sites; create_pull_request.cjs, 15+ sites) is execApi.exec(...) / execApi.getExecOutput(...), which the rule never sees. Proposed a narrow, disambiguated fix (array-as-2nd-arg heuristic) that won't collide with RegExp.prototype.exec(str).

Grounding detail and true negatives

• create_labels.cjs:46: const [bin, ...prefixArgs] = cmdPrefixStr.split(" ").filter(Boolean); feeding exec.getExecOutput(bin, ...) — currently benign (env-derived prefix) but exercises the exact defect mechanism live.
• git_helpers.cjs / create_pull_request.cjs: 35+ combined execApi.exec() / execApi.getExecOutput() call sites, all currently passing static "git" commands — no live true-positive missed today, but zero rule coverage on these files going forward.
• True negatives confirmed correct: function-parameter route args in add_reaction.cjs, add_workflow_run_comment.cjs (unresolvable by design, correctly unflagged); ternary-computed static routes in update_project.cjs:930 and create_project.cjs:230 (both branches static literals, correctly unflagged).
• Noted but not filed (ungrounded): ConditionalExpression/ternary branches are never unwrapped by isStaticExpression/isStaticRouteExpression in either the shared util or the route rule. No live instance has a dynamic ternary branch today, so this stays a watch-item rather than a filed issue.

Next actions

• Rotate to unreviewed rules by severity next: no-caught-error-interpolation, require-escaped-regexp-interpolation, require-execsync-try-catch/require-execfilesync-try-catch, require-spawnsync-error-check/require-spawn-error-listener are next in line (36 of 51 rules remain unreviewed at least once).
• Always gh search/issues before filing — this run found the memory's issue-tracking undercounted prior work by 15+ issues.
• Watch for a live dynamic-ternary-route/command instance to ground the unfiled ConditionalExpression ranking gap.

Repo-memory updated and validated (4.7 KB patch, well under the 12 KB limit).

Generated by 🤖 ESLint Refiner · agent · 279 AIC · ⌖ 5.05 AIC · ⊞ 5.3K · ◷

• expires on Aug 19, 2026, 9:32 PM UTC-08:00

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-08-20T05:32:31.761Z.

Closed by Workflow