[eslint-refiner] ESLint Refiner — 2026-09-06 daily report

[github-actions[bot]]

Overview

First run since 2026-07-08. The eslint-factory rule set grew significantly in the gap (12 -> 60 registered rules in src/index.ts), and this repo's shallow git clone means rule chronology can't be reconstructed from history — so this run switched strategy from "review the newest rule" to using open-issue presence per rule as a coverage proxy, prioritizing rules with zero open issues for fresh, grounded review.

Key metrics

• Rules registered: 60 (up from 12 last tracked run)
• Rules reviewed this run: 7
• Rules still never reviewed by this workflow: ~47
• Issues filed: 1 (quality over quantity — no live lint execution is possible in this sandbox, so every finding is grounded by hand via AST-logic tracing + corpus grep, which caps throughput)

Issue filed

• require-error-code-for-github-api-throw doesn't recognize octokit.request() calls — its isGitHubApiCall() helper only matches .graphql/.paginate calls or member chains containing .rest.; it silently misses the .request("METHOD /path", params) escape hatch, which is used at ~28 live call sites across 14+ files (8 of which already import error_codes.cjs, satisfying the rule's own precondition). Framed honestly: no live diagnostic is missed today because a broader sibling rule (require-error-code-in-thrown-error) currently provides a safety net for the same files — but the detection gap is real, contradicts the rule's own documented scope, and would go unprotected if that sibling rule ever narrows or diverges.

Rules reviewed this run — findings detail (7 rules)

Rule	Result
require-error-code-for-github-api-throw	Issue filed — .request() escape hatch not recognized (see above)
prefer-actions-exec-over-child-process	Already covered by 4 open issues (#58738, #58169, #58168, #57360) — skipped to avoid duplication
require-getexecoutput-exitcode-check	Already covered by open issue #57359 (git_helpers.cjs FP) — skipped
no-misplaced-error-code-definition	Corpus clean — no live gap found
require-http-response-error-listener	Corpus clean — all 4 live http/https call sites already attach res.on("error", ...)
no-math-minmax-array-spread	Corpus clean — zero live Math.min(...arr)/Math.max(...arr) sites
no-duplicate-constant-values	Partial — numeric/boolean/null duplicate thresholds checked sound; string-duplicate-value false-positive risk not yet fully checked

Also read require-invalid-date-check-before-compare in full (a complex guard-dominance-analysis rule) but did not reach a grounded conclusion — 81 files in the corpus use new Date(/Date.parse(, too broad to hand-audit in one sitting without live lint. Left as a priority for a future run with a narrower grep strategy.

Known constraints this run operated under

• eslint-factory has no node_modules/dist and npm is firewalled, so no live lint execution is possible — every finding is grounded by manually tracing rule AST logic and cross-referencing against the live .cjs corpus in actions/setup/js/ via grep.
• The repo is a shallow git clone (1 commit visible), so rule chronology/history cannot be reconstructed from git log; file mtimes are equally uninformative (all at checkout time).
• Scope remains eslint-factory/** targeting actions/setup/js/** only — Go analysis rules and JS outside that path are out of scope.

Next actions

• Next run: continue working through the ~47 never-reviewed rules (candidates noted in repo-memory: require-invalid-date-check-before-compare, no-duplicate-constant-values string-dup follow-up, require-error-code-in-thrown-error, no-string-fallback-for-non-string-message, require-nan-check-after-env-numeric-parse/-after-split-index-parse, require-fetch-response-body-try-catch, no-empty-catch-block, and others).
• Consider raising the README rule-documentation gap (60 registered rules vs. a much smaller documented table) as a follow-up doc issue if it's still out of date next run.
• Repo-memory (state.json, history.jsonl) updated and pushed with this run's findings, coverage-proxy strategy, and priorities for the next run.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by 🤖 ESLint Refiner · claude · agent · 350.7 AIC · ⌖ 8.51 AIC · ⊞ 5.8K · ◷

• expires on Sep 6, 2026, 9:35 PM UTC-08:00