[eslint-miner] eslint-factory: add require-nan-check-after-env-numeric-parse rule

[github-actions]

Summary

Adds a new ESLint rule, require-nan-check-after-env-numeric-parse, that flags numeric values parsed from process.env via parseInt, parseFloat, Number.parseInt, Number.parseFloat, or Number() when the result is never validated with Number.isNaN()/isNaN().

Rationale

These parsing functions silently return NaN for malformed environment input (empty string, typo, unexpected operator override) instead of throwing. An unvalidated NaN can then propagate silently into comparisons (e.g. rate-limit thresholds, size limits, timeouts), loop bounds, or GitHub API payloads without any error surfacing.

Evidence from actions/setup/js

Scanning actions/setup/js for parseInt/Number.parseInt/Number() calls whose argument traces back to process.env, then checking whether the resulting variable is ever passed to Number.isNaN/isNaN, surfaced 12 unvalidated occurrences across 9 files, none of which currently validate the parsed value:

• check_rate_limit.cjs (maxRuns, windowMinutes)
• push_repo_memory.cjs (maxFileSize, maxFileCount, maxPatchSize)
• handle_noop_message.cjs (maxCount)
• safe-outputs-mcp-server.cjs (port)
• write_daily_aic_usage_cache.cjs (runId, via Number())
• notify_comment_error.cjs (assignToAgentErrorCount)
• check_workflow_timestamp_api.cjs (runId)
• build_checkout_manifest.cjs (count)
• awf_reflect.cjs (configuredDelay)

This complements the existing require-parseInt-radix and prefer-number-isnan rules' focus on numeric-parsing footguns in actions/setup/js, but targets a distinct, unaddressed failure mode (unvalidated NaN propagation) rather than radix ambiguity or isNaN coercion.

Implementation

• New rule in eslint-factory/src/rules/require-nan-check-after-env-numeric-parse.ts, registered in src/index.ts and enabled (as warn) in eslint.config.cjs.
• Detects process.env access through member-expression chains, ||/?? fallbacks, optional chaining, ternaries, and simple chained calls (e.g. process.env.FOO?.trim()).
• Considers the variable validated if it is passed as the sole argument to isNaN(...) or Number.isNaN(...) anywhere in the enclosing scope.
• Added unit tests covering valid (validated) and invalid (unvalidated) cases, including parseInt, Number.parseInt, Number(), Number.parseFloat, and ternary-wrapped env access.
• Documented the rule in eslint-factory/README.md.

Validation

• cd eslint-factory && npm install
• cd eslint-factory && npm run build — passes
• cd eslint-factory && npx vitest run — 457 passed, 5 pre-existing failures in require-fs-io-try-catch.test.ts unrelated to this change (present on main without these changes)
• cd eslint-factory && npm run lint:setup-js — 0 errors, 70 warnings total (12 from the new rule); no new lint errors introduced

No files outside actions/setup/js and eslint-factory were modified.

---

Warning

Protected Files — Push Permission Denied

This was originally intended as a pull request, but the patch modifies protected files. A human must create the pull request manually.

Protected files

• README.md

The push was rejected because GitHub Actions does not have workflows permission to push these changes, and is never allowed to make such changes, or other authorization being used does not have this permission.

Create the pull request manually

# Download the patch from the workflow run
gh run download 30803670508 -n agent -D /tmp/agent-30803670508

# Create a new branch
git checkout -b eslint-miner/require-nan-check-after-env-numeric-parse-3d5d2385702a0a91 main

# Apply the patch (--3way handles cross-repo patches)
git am --3way /tmp/agent-30803670508/aw-eslint-miner-require-nan-check-after-env-numeric-parse.patch

# Push the branch and create the pull request
git push origin eslint-miner/require-nan-check-after-env-numeric-parse-3d5d2385702a0a91
gh pr create --title '[eslint-miner] eslint-factory: add require-nan-check-after-env-numeric-parse rule' --base main --head eslint-miner/require-nan-check-after-env-numeric-parse-3d5d2385702a0a91 --repo github/gh-aw

Generated by ESLint Miner · auto · 89 AIC · ⌖ 7.26 AIC · ⊞ 6.3K · ◷

• expires on Aug 10, 2026, 2:11 AM UTC-08:00