[eslint-refiner] ESLint Refiner daily report — 2026-09-11

[github-actions[bot]]

Overview

Reviewed 6 previously-untouched eslint-factory rules against the live actions/setup/js/** corpus. Filed 2 new issues — one strongly grounded (8 live escape sites), one structural/latent — and cleared 4 rules with no gap found.

Key metrics

• Rules reviewed this run: 6 (no-err-stack-then-string-fallback, no-setfailed-then-exit-zero, no-caught-error-interpolation, prefer-structured-clone, require-lastindex-reset-before-global-exec-loop, no-empty-catch-block)
• Issues created: 2
• Live escaping call sites found (issue rejig docs #1 alone): 8, across 8 distinct non-test files
• Total rules registered in eslint-factory: 62 (unchanged since 2026-09-09)
• Currently open eslint-factory-labeled issues (all runs, post-dedupe): 9

Issues filed today

1. no-err-stack-then-string-fallback misses getErrorMessage() fallback and combined instanceof+.stack test shape — the rule's ternary matcher only recognizes errVar && errVar.stack ? errVar.stack : String(errVar). It doesn't recognize getErrorMessage(errVar) as a valid alternate, and it can't resolve errVar when the test combines instanceof Error and .stack in one &&. Result: every live occurrence of this idiom in the corpus escapes detection — including two call sites that feed straight into core.setFailed(), so a raw stack trace becomes the visible GitHub Actions failure message.
2. no-setfailed-then-exit-zero: TryStatement is an unhandled control-flow blind spot — neither of the rule's two recursive control-flow helpers has a case for try/catch/finally, so core.setFailed() calls inside a try block are invisible to the sibling-statement scanner that looks for a following process.exit(0). No live pairing found yet, but setFailed-inside-try is used in 23 files, so the blind spot is broadly reachable.

Full per-rule review notes

no-err-stack-then-string-fallback (issue filed): isStringErr() hard-codes String(errVar) as the only accepted alternate branch — it doesn't recognize getErrorMessage(errVar), which is literally the rule's own suggested fix. Separately, the ConditionalExpression handler requires test.left to be a bare Identifier, so it can't parse the combined errVar instanceof Error && errVar.stack test — the single most common shape of this idiom in the corpus. Grepped every .stack reference in non-test .cjs files and found 8 live matches that hit one of these two gaps:

• apply_samples.cjs:720, merge_remote_agent_github_folder.cjs:459 — core.setFailed(err && err.stack ? err.stack : getErrorMessage(err))
• parse_mcp_gateway_log.cjs:1341 — same shape via console.error
• copilot_sdk_driver.cjs:141, pi_agent_core_driver.cjs:404, parse_mcp_scripts_logs.cjs:416, detect_agent_errors.cjs:616, create_issue.cjs:1385 — combined instanceof Error && .stack test shape

Confirmed via no-err-stack-then-string-fallback.test.ts that neither shape has any test coverage today.

no-setfailed-then-exit-zero (issue filed, latent): statementCanSetFailedAndContinue() and canContinueNormally() handle ExpressionStatement, BlockStatement, and IfStatement, but have no TryStatement case. A core.setFailed() inside a try block (or catch handler) doesn't register as "activating the failed path," so a process.exit(0) in a sibling finally block, or as a statement following the whole try, is never checked against it. Grepped and found 23 files where core.setFailed(...) appears textually inside a try { ... } — a common idiom — but none currently pair it with a stray exit(0)/exitCode = 0, so this is filed as a structural/test-coverage gap rather than a currently-firing false negative. Zero try/finally test cases exist in no-setfailed-then-exit-zero.test.ts.

no-caught-error-interpolation (no issue): Checked for aliasing gaps beyond the existing single-hop const x = err chain-following (e.g. let-reassignment, += compound concatenation). Found one let current = error; in update_pull_request.cjs:31, but current is only walked for a .status property there, never interpolated — not a real violation. No live +=-with-caught-error pattern found either. Rule appears sound against the current corpus.

prefer-structured-clone (no issue): Only one non-test live JSON.parse(JSON.stringify(...)) call site (pick_experiment.cjs:268, cloning a plain-data run record with no function-valued properties) — the rule's function-property withholding logic doesn't even need to engage here, and the suggested structuredClone(run) autofix is safe and correct.

require-lastindex-reset-before-global-exec-loop (no issue): All 4 live while ((match = regex.exec(...)) !== null) sites (frontmatter_hash_pure.cjs:338/362/431, patch_path_helpers.cjs:123) declare their stateful regex inside the enclosing function rather than at module scope, so the rule's module-scope-only tracking correctly does not flag them — a fresh regex per call has lastIndex reset naturally. No gap found.

no-empty-catch-block (no issue): Reviewed the intentional-ignore comment heuristics (negation detection, adjacency window, ancestor-statement comment search) closely; did not find a live corpus counterexample worth filing.

Next actions

• Continue working through the ~40 still-unreviewed rules; next up per updated strategy: prefer-core-logging, require-escaped-regexp-interpolation, require-page-counter-increment-in-while-true-loop, require-invalid-date-check-before-compare, require-sync-exec-timeout, require-nan-check-after-env-numeric-parse / -after-split-index-parse.
• Watch for the two issues filed today to be picked up before their ~1-week auto-expire window (see prior-run learning: unfixed issues get bot-closed as not_planned, not resolved).
• Re-verify require-http-response-error-listener's 2026-09-09 latent finding is still open before it's due to expire.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by 🤖 ESLint Refiner · claude · agent · 280.2 AIC · ⌖ 7.75 AIC · ⊞ 5.8K · ◷

• expires on Sep 11, 2026, 9:53 PM UTC-08:00