[eslint-refiner] ESLint Refiner - 2026-09-05: @actions/exec shell-semantics & exec() scope gap (2 issues filed)

[github-actions[bot]]

Overview

Today's run reviewed the two newest-registered rules in eslint-factory/src/index.ts (61 rules total, up from 12 tracked in this memory branch's last update on 2026-07-08 - a significant reconciliation was needed this run). Both reviewed rules concern @actions/exec vs Node's child_process module. Filed 2 non-duplicate issues; a third candidate was investigated and dropped because it turned out to already be covered by an existing open issue.

Key metrics

• Rules reviewed: 2 (prefer-actions-exec-over-child-process, require-getexecoutput-exitcode-check), plus 1 checked-but-skipped (no-string-fallback-for-non-string-message)
• Issues filed: 2 / 3 max (quality-over-cap - no third finding was sufficiently grounded)
• Memory reconciliation: local rule-tracking count corrected from 12 -> 61 to match live index.ts

Issues filed

1. prefer-actions-exec-over-child-process: blanket suggestion ignores shell semantics. The rule suggests migrating all of exec/execSync/execFile/execFileSync to @actions/exec uniformly, but exec()/execSync() run their command string through a shell (pipes, ||, redirection, globbing) while @actions/exec's exec()/getExecOutput() do not by default - a literal swap silently breaks shell-syntax commands. Grounded in actions/setup/js/validate_secrets.cjs's promisified exec('which copilot 2>/dev/null || echo ""').
2. require-getexecoutput-exitcode-check: scope gap on exec.exec(). The rule only inspects .getExecOutput(...) calls, missing the identical ignoreReturnCode: true + discarded-exit-code hazard on the sibling exec() API (which returns the exit code directly as a number rather than via an object). Grounded in actions/setup/js/check_workflow_recompile_needed.cjs:277-298's bare await exec.exec("git", [...], { ignoreReturnCode: true, ... }) with the return value never captured.

Why a third issue wasn't filed

no-string-fallback-for-non-string-message was reviewed as a candidate for a false-positive finding (deep optional-chained .message access falling back to String(<root>)). Before filing, the duplicate-check against open issues surfaced #58400, which already treats the exact same live instances (dispatch_workflow.cjs, route_slash_command.cjs, safeoutputs_cli.cjs) as confirmed true positives needing only an autofix - directly contradicting the working hypothesis. Abandoned rather than file a duplicate/contradictory issue.

Memory reconciliation detail

This memory branch (memory/eslint-refiner) had not been updated since 2026-07-08 and only tracked 12 of the now-61 registered rules. Rather than trust the stale local priorOpenIssues list, this run used gh api repos/github/gh-aw/issues and gh api search/issues directly as the dedupe source of truth. state.json has been rewritten to drop the now-superseded per-rule finding detail from the 12-rule era and instead point at live index.ts + gh api as sources of truth, with a fresh list of not-yet-deep-reviewed rules for future runs to work through.

Next actions

• Continue reviewing the ~55+ rules not yet deep-reviewed across prior runs (fs-sync family, error-cause, setoutput, isnan, getexecoutput, prefer-actions-exec, and a handful more have been covered; most of the newer try-catch/interpolation/timeout rules have not). Priority list recorded in state.json.
• Watch for maintainer response on the shell-semantics caveat (issue 1) and the exec() scope-gap (issue 2) - both are cheap, well-scoped rule refinements reusing existing helper functions.
• Keep using gh api (not gh issue list --search --json, which throws a version error) for dedupe going forward.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by 🤖 ESLint Refiner · claude · agent · 357 AIC · ⌖ 7.82 AIC · ⊞ 5.8K · ◷

• expires on Sep 5, 2026, 9:35 PM UTC-08:00