[eslint-refiner] ESLint Refiner daily report — 2026-09-24 (0 issues filed; #61543 appears fixed upstream)

[github-actions[bot]]

Overview

Daily ESLint Refiner sweep of eslint-factory (62 custom rules, unchanged count) against the live actions/setup/js/**/*.cjs corpus. Disciplined 0-issue day — every avenue investigated was either already fixed upstream, already open and re-confirmed unfixed, or a structurally-real-but-corpus-ungrounded theory that doesn't clear the filing bar. One valuable discovery: an open issue's underlying bug appears already fixed in source.

Key findings

• require-spawnsync-error-check (require-spawnsync-error-check: CHILD_PROCESS_OBJECTS name allowlist misses the common cp require alias #61543) looks fixed upstream but is still open. isSpawnSyncCall now resolves the child_process namespace object via the shared isChildProcessObjectBinding scope-resolved helper instead of the old hardcoded CHILD_PROCESS_OBJECTS name Set — exactly the gap require-spawnsync-error-check: CHILD_PROCESS_OBJECTS name allowlist misses the common cp require alias #61543 describes. This workflow has no close_issue/comment safe-output, so it needs a human (or PR-capable workflow) to verify and close it. This is the second confirmed case of a fix landing without the issue being closed (after prefer-actions-exec-over-child-process: false positive on shim.cjs dual-mode standalone/github-script files #61044 on 2026-09-23) — the ~1wk bot auto-expiry is not a reliable signal that a theme is actually dead.
• Still open and re-confirmed unfixed in current source:
  • require-invalid-date-check-before-compare: arithmetic-derived duration variables still escape tracking (recurrence of #60577) #62317 require-invalid-date-check-before-compare — arithmetic-derived duration variables (e.g. (a.getTime() - b.getTime())/1000) still escape NaN-comparison tracking.
  • no-string-fallback-for-non-string-message: false positive on type-narrowed catch-param alias (recurrence of #60757) #62560 no-string-fallback-for-non-string-message — nullish-coalescing/type-narrowed aliases of a catch binding still aren't resolved to the same key.
  • require-fetch-response-body-try-catch: trailing .catch()/.then() on the body-read call hides it from the rule #61542 require-fetch-response-body-try-catch — a trailing .catch()/.then() chained directly onto the body-read call still hides it from the AwaitExpression visitor.
• require-error-code-in-thrown-error: ERROR_CODE_PATTERN does not recognize error_codes.cjs non-ERR_/E0xx exports #61285 / require-error-code-in-thrown-error: nested identifier aliases inside binary/template messages bypass write-once resolution (fals #61284 (require-error-code-in-thrown-error) expired 2026-09-23, not refiled. Both gaps are still structurally present in source, but re-grounding against the live corpus found the same result as their original filing: the registry's one non-ERR_-prefixed export (POLICY_FILE_PROTECTION_DENIED_REASON_CODE) is only ever assigned to an object property (reasonCode: ...), never used inside a thrown Error message, so there's still no live trigger. Per this project's established practice for ungrounded latent themes, these are documented but not refiled a second time without new evidence.
• New code reviewed clean: the 2026-09-23 PR Improve detection and diagnostics for missing Copilot custom agent #63048 (Copilot custom-agent diagnostics) added/expanded detect_agent_errors.cjs. Both new JSON.parse call sites and the fs.readFileSync call are already correctly wrapped in try/catch. No gap found.

Full methodology and rule-by-rule detail

• Rule inventory reconfirmed at 62 via grep -l '= createRule(' eslint-factory/src/rules/*.ts (excluding .test.ts) — unchanged since 2026-09-19.
• Dedup source of truth: gh api "repos/github/gh-aw/issues?state=open&labels=eslint-factory" (4 open: no-string-fallback-for-non-string-message: false positive on type-narrowed catch-param alias (recurrence of #60757) #62560, require-invalid-date-check-before-compare: arithmetic-derived duration variables still escape tracking (recurrence of #60577) #62317, require-spawnsync-error-check: CHILD_PROCESS_OBJECTS name allowlist misses the common cp require alias #61543, require-fetch-response-body-try-catch: trailing .catch()/.then() on the body-read call hides it from the rule #61542) cross-checked against a broader title/body search that also surfaced the two now-expired require-error-code-in-thrown-error: ERROR_CODE_PATTERN does not recognize error_codes.cjs non-ERR_/E0xx exports #61285/require-error-code-in-thrown-error: nested identifier aliases inside binary/template messages bypass write-once resolution (fals #61284.
• git log/git show --stat is conclusively unusable for change detection in this repo — the 2026-09-23→09-24 HEAD move (606cfab → e04de66, Improve detection and diagnostics for missing Copilot custom agent #63048) is the 7th consecutive all-insertions shallow-clone squash artifact (881 files, 0 deletions). Pivoted instead to grepping the PR's actual named subject file (detect_agent_errors.cjs) directly for rule-relevant patterns (JSON.parse, readFileSync, catch, throw new Error) rather than relying on a diff.
• require-spawnsync-error-check: read current source line-by-line; confirmed isSpawnSyncCall (line 158) now calls isChildProcessObjectBinding(callee.object.name, callee.object, sourceCode) from try-catch-rule-utils.ts, matching the shared helper 4 sibling rules already use.
• require-fetch-response-body-try-catch: confirmed the AwaitExpression visitor still requires getMemberPropertyName(callee) to be literally json/text (line 175) before any chain-unwrap logic runs — a trailing .catch()/.then() resolves methodName to catch/then and short-circuits.
• require-invalid-date-check-before-compare: confirmed the BinaryExpression visitor and resolveVariable helper still only track comparison operands, not arithmetic-derived assignments.
• no-string-fallback-for-non-string-message: confirmed alternateChainKey must still textually equal messageChainKey (minus .message) with no alias resolution for nullish-coalescing narrowing.
• require-error-code-in-thrown-error: re-read messageReferencesErrorCode — its BinaryExpression/TemplateLiteral nested-identifier branches (lines 20–30) still match by bare ERROR_CODE_PATTERN name only, never via resolveWriteOnceInitializerChain (unlike the top-level Identifier branch in auditMessageExpression). ERROR_CODE_PATTERN is still ERR_*/E[0-9]{3}-only. Grepped all 3 live consumers of POLICY_FILE_PROTECTION_DENIED_REASON_CODE (approve_workflow_run.cjs:372, push_to_pull_request_branch.cjs:529,1124) — all are reasonCode: property assignments, none inside a thrown Error message.
• core-method-resolve.ts multi-hop core alias theory (carried from 09-23): re-grepped for const \w+ = core;-shape bindings across the corpus — still zero occurrences, theory remains undocumented-but-ungrounded.
• Two chronic, twice-expired themes are intentionally not refiled a third time (established practice): the try-catch-rule-utils.ts VariableDeclaration-suggestion gap (~14 fs-sync/child-process rules affected, eslint-factory: shared try/catch suggestion builder silently skips VariableDeclaration call sites #57868/eslint-factory: shared try/catch suggestion builder still skips VariableDeclaration call sites -- recurrence of expired issue 57 #59891) and the no-json-stringify-equality indirect-operand gap (no-json-stringify-equality: misses indirect template-literal comparisons (live gap: trace_graders.cjs gradeLoops) #57869/no-json-stringify-equality: still misses indirect template-literal comparisons -- recurrence of expired issue 57869 #59892). Both require a source-level fix this workflow cannot submit (no create_pull_request safe-output) — flagging here for a human or PR-capable workflow.

Next actions

1. Human/PR-capable workflow: verify and close require-spawnsync-error-check: CHILD_PROCESS_OBJECTS name allowlist misses the common cp require alias #61543 — the underlying bug is fixed in source.
2. Human/PR-capable workflow: land a source fix for the two chronic multi-rule gaps (try-catch-rule-utils.ts VariableDeclaration suggestions; no-json-stringify-equality indirect operands) — this refiner workflow can only file issues, not PRs.
3. No new issues filed today; no-string-fallback-for-non-string-message: false positive on type-narrowed catch-param alias (recurrence of #60757) #62560, require-invalid-date-check-before-compare: arithmetic-derived duration variables still escape tracking (recurrence of #60577) #62317, and require-fetch-response-body-try-catch: trailing .catch()/.then() on the body-read call hides it from the rule #61542 remain open and accurately describe unfixed behavior — no action needed beyond normal triage.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by 🤖 ESLint Refiner · claude · agent · 262.1 AIC · ⌖ 6.98 AIC · ⊞ 6K · ◷

• expires on Sep 24, 2026, 9:32 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by ESLint Refiner.

A newer discussion is available at Discussion #63360.