[eslint-refiner] ESLint Refiner — Daily Report (2026-08-07)

[github-actions[bot]]

Scope: eslint-factory/** custom rules targeting actions/setup/js/** scripts.

Headline: the rule package outgrew the review cadence

Last run was 2026-07-08 (12 rules registered, all reviewed at least once). Today eslint-factory/src/index.ts registers 39 rules — 27 new since then. This run reviewed 1 new rule in depth; 26 rules remain unreviewed. Recommend either running this workflow more frequently or reviewing multiple new rules per run going forward (findings/issue cap stays at 3/run either way).

This run: require-fetch-response-body-try-catch

Reviewed the rule requiring .json()/.text() reads on a fetch() Response to be wrapped in try/catch. Grounded review against all 14 live fetch(...) call sites in actions/setup/js (artifact_client.cjs, awf_reflect.cjs, apply_samples.cjs, exchange_otlp_workload_identity.cjs, validate_secrets.cjs, check_version_updates.cjs, send_otlp_span.cjs). Most already correctly wrapped; the rule also correctly identifies 2 genuinely-unwrapped live sites (artifact_client.cjs:237, :292) — good signal the rule is sound on the happy path.

2 issues filed:

1. [HIGH, grounded] Autofix suggestion can break real code. Both require-fetch-response-body-try-catch and require-json-parse-try-catch include VariableDeclaration in their suggestion-eligible statement types. Wrapping const payload = await response.json(); in a new try {} scopes payload inside that block — any use on a later line becomes a ReferenceError. Grounded live at artifact_client.cjs:295-296, where payload is read on the very next line. require-new-url-try-catch already identified and designed around this exact hazard by excluding VariableDeclaration from its suggestions; the other two rules didn't follow that precedent.
2. [MEDIUM, ungrounded/latent] Scope-resolution soundness gaps. resolvesToBareAwaitFetch matches on any write reference to a variable rather than the one that actually reaches the read (reassign-to-safe-value patterns would still misfire), and has no one-hop const-alias resolution — inconsistent with no-github-request-interpolated-route, which already resolves simple aliases like const gh = github. No live corpus site hits this today; flagged before a retry/fallback or aliasing pattern gets added.

Dedup check against other workflows

Confirmed 2 already-open issues from sibling workflows (eslint-monster, lint-monster) covering rules in this same package's target surface: #50496 (require-nan-check-after-env-numeric-parse) and #49914 (no-child-process-interpolated-command). Recorded in memory so future runs on those rules don't duplicate the same angle.

Repo-memory

State, findings, and history updated and validated (push_repo_memory: 8 files, 16 KB total, 6 KB patch — within the 12 KB limit). state.json now tracks the full 26-rule unreviewed backlog in registration order to drive the next several runs.

Next run priorities

• Pick up the next unreviewed rule nearest the bottom of index.ts (see unreviewedRulesInIndexOrder in memory).
• Consider reviewing 2+ new rules per run to close the backlog given the cadence gap.
• Re-verify README rule count (currently lists all rules reasonably) once the backlog review catches up.

Generated by 🤖 ESLint Refiner · agent · 215.7 AIC · ⌖ 31.5 AIC · ⊞ 4.9K · ◷

• expires on Aug 7, 2026, 9:55 PM UTC-08:00