[Code Quality] Fix ESLint require-spawnsync-error-check: misses destructured spawnSync and weak error guards

[github-actions]

Description

The ESLint Refiner daily report (2026-07-14) identified two soundness gaps in the require-spawnsync-error-check rule:

1. Destructuring assignment missed: const { status } = spawnSync() is not analyzed — only const <id> = spawnSync() is matched. This is the worst-case scenario because .error is not bound to any variable and cannot be checked.
2. Weak error guard accepted: hasErrorCheck accepts any .error read (including a console.log(result.error)) as a valid check, rather than requiring an actual guard like if (result.error) throw.

Real true-positive sites exist: apply_samples.cjs:97, artifact_client.cjs, send_otlp_span.cjs:823.

Suggested Changes

1. In the require-spawnsync-error-check rule, add a VariableDeclarator visitor for destructured patterns (ObjectPattern) that flags the call when .error is not destructured
2. Tighten hasErrorCheck to require the .error read appears inside a conditional/throw, not just any read

Files Affected

• actions/setup/js/eslint-factory/ — require-spawnsync-error-check rule implementation

Success Criteria

• const { status } = spawnSync() is flagged when .error is not extracted
• console.log(result.error) does NOT satisfy the check; if (result.error) throw does
• git_helpers.cjs:87 (correct guard) remains a true negative
• All existing rule tests pass

Source

Extracted from ESLint Refiner Daily Report — 2026-07-14 discussion #45388

Priority

Medium — soundness gaps leave real call sites unguarded

🔍 Task mining by Discussion Task Miner - Code Quality Improvement Agent · 180.5 AIC · ⌖ 7.67 AIC · ⊞ 7K · ◷

• expires on Jul 15, 2026, 5:18 PM UTC-08:00

[github-actions]

This issue was automatically closed because it expired on 2026-07-16T01:18:56.788Z.

Closed by Workflow