[eslint-refiner] ESLint Refiner daily report — 2026-08-29

[github-actions[bot]]

Overview

Reviewed the 2 newest custom ESLint rules (by index.ts import order) targeting actions/setup/js/**: require-getexecoutput-exitcode-check and prefer-actions-exec-over-child-process. Both had a grounded live gap in production .cjs code. Filed 2 non-duplicate issues (quality over cap — did not pad to 3). Also discovered a continuity gap in this workflow's own memory that changes how future runs should operate.

Key metrics

• Rules reviewed this run: 2
• Issues filed: 2 (0 skipped as duplicates)
• Total custom rules now registered: 59 (up from 12 last recorded review, 2026-07-08)
• Rules never yet reviewed by this workflow: ~45

Issues filed

1. require-getexecoutput-exitcode-check — options passed by variable reference bypass ignoreReturnCode detection entirely. Grounded in git_helpers.cjs's linearizeRangeAsCommit(), where a shallowOpts variable carries ignoreReturnCode: true but the rule never inspects it (only inline object literals are checked), so a shallow-checkout safety guard is silently defeated on any git failure.
2. prefer-actions-exec-over-child-process — flags execSync/execFile* calls uniformly, without noting that migrating a call inside a non-async function whose return value is consumed synchronously requires cascading async/await through every caller. Grounded in get_current_branch.cjs, called synchronously from 4 sites in handle_agent_failure.cjs and safe_outputs_handlers.cjs. Confirmed independent of the already-open shim.cjs dual-mode issue (eslint-factory: prefer-actions-exec-over-child-process false-positives on shim.cjs dual-mode scripts #55944).

Full grounding detail

Issue 1 — require-getexecoutput-exitcode-check

hasIgnoreReturnCodeTrue() only inspects the call's last argument when it's an inline ObjectExpression. When options are an Identifier referencing a variable holding { ignoreReturnCode: true, ... }, the function returns false immediately and the rule skips the call entirely — this is a documented, intentional scope limit in the rule's own test suite.

git_helpers.cjs (lines ~806-808):

const shallowOpts = gitOpts !== undefined ? { ...gitOpts, ignoreReturnCode: true } : { ignoreReturnCode: true };
const { stdout: shallowOut } = await execApi.getExecOutput("git", ["rev-parse", "--is-shallow-repository"], shallowOpts);
isShallow = shallowOut.trim() === "true";

exitCode is never checked. This probe exists to decide whether an implausible commit range is safe to rewrite (shallow checkout) vs. should throw (real anomaly) — any transient git failure here silently resolves to isShallow = false, letting a rewrite proceed on an unverified range.

Ask: resolve simple local-variable option arguments via scope lookup when the initializer is itself an ObjectExpression, applying the same source-order/spread evaluation already used for inline objects. Also flagged probeOptions/fetchOptions in the same file as needing an audit (detection-bypassed, not confirmed buggy).

Issue 2 — prefer-actions-exec-over-child-process

get_current_branch.cjs's getCurrentBranch() is a synchronous function using execSync, returning a plain string, called without await from 4 production sites. Migrating the flagged call to @actions/exec's Promise-only API means converting getCurrentBranch — and every one of its 4 callers — to async. The rule's current message implies a same-line swap, hiding this multi-file cascade cost. This file has no shim.cjs require, so it's confirmed unrelated to open issue #55944.

Ask: add a distinct messageId (or message clause) when the enclosing function is non-async and the call's return value is consumed non-trivially (assigned/returned), signaling the async-conversion cascade explicitly.

Memory continuity gap

This run's rule inventory (59) jumped sharply from the last recorded review (12, dated 2026-07-08), with no history.jsonl entries in between — meaning either runs occurred without memory persisting, or writes were lost/overwritten. Going forward, gh api issue history (label eslint-factory) will be cross-checked alongside repo-memory each run rather than trusting memory continuity alone.

Next actions

• Work through the ~45-rule review backlog systematically (oldest-never-reviewed first), rather than always the 2 newest.
• Once either fix lands, re-verify the grounding sites called out above (git_helpers.cjs shallowOpts; get_current_branch.cjs) are handled correctly, and check for regressions.
• Raise README rule-documentation debt (2 of 59 rules documented) as a follow-up discussion item or doc issue.
• Repo-memory updated with today's findings, refreshed rule count, and revised next-priorities.

References:

• §33235866343

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by 🤖 ESLint Refiner · claude · agent · 258 AIC · ⌖ 6.41 AIC · ⊞ 5.8K · ◷

• expires on Aug 29, 2026, 9:36 PM UTC-08:00