prefer-actions-exec-over-child-process: computed member access (cp["execSync"](...)) escapes detection

[github-actions]

Summary

resolveChildProcessMemberMethod in eslint-factory/src/rules/prefer-actions-exec-over-child-process.ts requires !node.computed before resolving a MemberExpression to a child_process output-capturing method:

function resolveChildProcessMemberMethod(node, ...) {
  if (node.computed) return undefined; // (paraphrased) bracket access is never resolved
  ...
}

As a result, cp["execSync"](cmd) or cp[methodName](cmd) on a resolved child_process-derived binding is never flagged, even though it invokes the exact same output-capturing method (exec/execSync/execFile/execFileSync) that dot-notation access on the same object would correctly trigger.

Grounding status

No live instance of computed member access on a child_process binding exists in the current actions/setup/js/**/*.cjs corpus (grepped for child_process-style bracket-access patterns across all .cjs files — zero matches). This is a soundness gap, not a currently-observed false negative — filed proactively because it is a cheap, well-scoped fix and matches this project's precedent of filing ungrounded-but-clearly-correct soundness gaps (e.g. the require-fs-sync-try-catch catch-less try/finally fix landed from an ungrounded finding on 2026-07-08).

Ask

Extend resolveChildProcessMemberMethod to also resolve computed member access when the property is statically determinable: a string literal (cp["execSync"]) or an identifier resolvable to a const-bound string literal in an enclosing scope. Leave genuinely dynamic property access (computed from a runtime value) unresolved, consistent with the rule's existing conservative-resolution philosophy elsewhere (e.g. resolveChildProcessOutputMethodBinding's handling of promisify/destructure/alias forms).

Acceptance criteria

• Add test cases: cp["execSync"](cmd) and cp["exec"](cmd, cb) on a resolved child_process binding are flagged identically to their dot-notation equivalents.
• Add a test case confirming a truly dynamic computed property (e.g. cp[methodName] where methodName is a function parameter, not a resolvable literal) remains unflagged — no false positives from over-eager resolution.
• No regressions in the existing dot-notation test suite (prefer-actions-exec-over-child-process.test.ts).

Scope note

Filed under the ESLint Refiner mission for eslint-factory/** custom TypeScript ESLint rules, targeting actions/setup/js/** as the grounding corpus.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by 🤖 ESLint Refiner · claude · agent · 308.6 AIC · ⌖ 7.7 AIC · ⊞ 5.8K · ◷

• expires on Sep 6, 2026, 9:36 PM UTC-08:00