[eslint-refiner] ESLint Refiner — daily report (2026-09-25)

[github-actions[bot]]

Scope: eslint-factory/** (62 custom TS-ESLint rules, unchanged count since 2026-09-19), targeting actions/setup/js/** as the live corpus (no node_modules/dist — all findings are grounded via static review + grep, not a live lint run).

Summary

• 1 issue filed: a recurrence of require-fetch-response-body-try-catch: trailing .catch()/.then() on the body-read call hides it from the rule #61542 (require-fetch-response-body-try-catch chain-unwrap gap), which expired unfixed via the bot's ~1-week auto-close TTL.
• 2 issues remain open from prior runs: require-invalid-date-check-before-compare: arithmetic-derived duration variables still escape tracking (recurrence of #60577) #62317 and no-string-fallback-for-non-string-message: false positive on type-narrowed catch-param alias (recurrence of #60757) #62560.
• Confirmed a 3rd instance of a genuine upstream fix landing without the tracking issue being closed as fixed (see below) — a recurring gap in the fix→close feedback loop worth human attention.
• git log/git show --stat change detection is now dead across 8 consecutive runs — every recent HEAD move is an all-insertions shallow-clone squash artifact with zero deletions, so it no longer signals real diffs.

Issue filed

• require-fetch-response-body-try-catch: chain-unwrap gap hides .catch()/.then()-chained body reads (recurrence of require-fetch-response-body-try-catch: trailing .catch()/.then() on the body-read call hides it from the rule #61542) — the rule's AwaitExpression visitor only inspects the outermost call, so await res.text().catch(handler) is invisible to it. Still live and unchanged at actions/setup/js/validate_secrets.cjs:70,91; neither call site is wrapped in try/catch, and the .catch handler only special-cases AbortError, silently letting every other rejection (malformed/truncated body — the exact failure this rule targets) through unhandled.

Full diagnostic detail and re-verification notes

• Root cause unchanged in eslint-factory/src/rules/require-fetch-response-body-try-catch.ts (L168-175): methodName is read off the outermost call only; a trailing .catch/.then/.finally segment resolves methodName to catch/then/finally and the visitor bails before ever inspecting the underlying .json()/.text() call. The sibling rule require-fetch-try-catch's getAwaitedFetchInfo already walks back through chained segments for the same reason — this rule doesn't.
• require-fetch-response-body-try-catch.test.ts still has zero test cases for a chained .catch()/.then() shape.
• require-fetch-response-body-try-catch: trailing .catch()/.then() on the body-read call hides it from the rule #61542 and require-spawnsync-error-check: CHILD_PROCESS_OBJECTS name allowlist misses the common cp require alias #61543 (require-spawnsync-error-check) expired in the same batch (2026-09-24T06:55, both not_planned). require-spawnsync-error-check: CHILD_PROCESS_OBJECTS name allowlist misses the common cp require alias #61543 was already confirmed fixed upstream on 2026-09-24 — isSpawnSyncCall now delegates to the shared isChildProcessObjectBinding helper instead of a hardcoded name Set — so it was correctly not refiled. This is the 3rd confirmed case (after prefer-actions-exec-over-child-process: false positive on shim.cjs dual-mode standalone/github-script files #61044 and require-spawnsync-error-check: CHILD_PROCESS_OBJECTS name allowlist misses the common cp require alias #61543 itself) of a real fix landing in source without the corresponding issue ever being closed as fixed; this workflow has no close_issue/add_comment safe-output, so each instance can only be surfaced here for a human or a PR-capable workflow to reconcile.
• Two theories re-checked again with no new grounding, so not filed: core-method-resolve.ts's single-hop-only alias resolution (3rd check, zero live const x = core;-style aliasing in non-test code) and no-json-stringify-equality's indirect-variable operand gap (re-grepped every = JSON.stringify( assignment corpus-wide; all matches are in *.test.cjs, which the lint config excludes).
• Also noted, non-actionable: actions/setup/js/evaluate_outcomes.cjs:1057 has a direct JSON.stringify(a) === JSON.stringify(b) comparison — this is exactly the shape no-json-stringify-equality is designed to catch, so it's confirmation the rule works correctly here, not a gap.

Next actions

• Watch require-invalid-date-check-before-compare: arithmetic-derived duration variables still escape tracking (recurrence of #60577) #62317 and no-string-fallback-for-non-string-message: false positive on type-narrowed catch-param alias (recurrence of #60757) #62560 (created 09-21 and 09-22) for their own expiry; if either lapses unfixed, refile as a 2nd-generation recurrence, but a 2nd expiry on either would cross this workflow's established threshold for treating it as a chronic, discussion-only theme instead.
• Human/PR-capable follow-up requested: reconcile prefer-actions-exec-over-child-process: false positive on shim.cjs dual-mode standalone/github-script files #61044, require-spawnsync-error-check: CHILD_PROCESS_OBJECTS name allowlist misses the common cp require alias #61543 (and now this pattern generally) where source fixes have landed but issues auto-expired as not_planned rather than being closed as fixed.
• The chronic try-catch-rule-utils.ts VariableDeclaration-suggestion gap (affects ~14 fs-sync/child-process rules, twice-filed-and-expired as eslint-factory: shared try/catch suggestion builder silently skips VariableDeclaration call sites #57868/eslint-factory: shared try/catch suggestion builder still skips VariableDeclaration call sites -- recurrence of expired issue 57 #59891) and the no-json-stringify-equality indirect-operand gap (no-json-stringify-equality: misses indirect template-literal comparisons (live gap: trace_graders.cjs gradeLoops) #57869/no-json-stringify-equality: still misses indirect template-literal comparisons -- recurrence of expired issue 57869 #59892) remain real per source review but need a source-level fix via a PR-capable workflow — this workflow can only flag them, not submit the fix.

Generated by 🤖 ESLint Refiner · claude · agent · 153 AIC · ⌖ 9.07 AIC · ⊞ 6K · ◷

• expires on Sep 25, 2026, 9:31 PM UTC-08:00

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-09-26T05:31:26.873Z.

Closed by Workflow