[eslint-monster] setup/js: fix unsafe catch-property access and dynamic pattern construction warnings

[github-actions]

Summary

Daily npm run lint:setup-js found a cluster of safety warnings in actions/setup/js around direct property access on caught values and dynamic pattern construction.

Root cause group

Normalize caught-value handling before reading properties, and use explicit escaping or safer construction when building regular expressions or shell/process invocations.

Affected files

• actions/setup/js/check_permissions_utils.cjs
• actions/setup/js/checkout_manifest.cjs
• actions/setup/js/comment_memory_helpers.cjs
• actions/setup/js/frontmatter_hash_pure.cjs
• actions/setup/js/fuzz_template_substitution_harness.cjs
• actions/setup/js/glob_pattern_helpers.cjs
• actions/setup/js/interpolate_prompt.cjs
• actions/setup/js/mcp_server_core.cjs
• actions/setup/js/model_aliases.cjs
• actions/setup/js/push_repo_memory.cjs
• actions/setup/js/remove_trigger_label.cjs
• actions/setup/js/resolve_mentions_from_payload.cjs
• actions/setup/js/resolve_model_alias.cjs
• actions/setup/js/safe_output_type_validator.cjs
• actions/setup/js/sanitize_content_core.cjs
• actions/setup/js/start_mcp_gateway.cjs
• actions/setup/js/write_large_content_to_file.cjs

Representative diagnostics

• actions/setup/js/check_permissions_utils.cjs:206 — gh-aw-custom/no-unsafe-catch-error-property
• actions/setup/js/checkout_manifest.cjs:59 — gh-aw-custom/no-unsafe-catch-error-property
• actions/setup/js/comment_memory_helpers.cjs:70 — gh-aw-custom/require-escaped-regexp-interpolation
• actions/setup/js/start_mcp_gateway.cjs:741 — gh-aw-custom/no-child-process-interpolated-command
• actions/setup/js/safe_output_type_validator.cjs:45 — gh-aw-custom/require-escaped-regexp-interpolation
• actions/setup/js/write_large_content_to_file.cjs:20 — gh-aw-custom/no-unsafe-catch-error-property

Expected outcome

Handle caught values defensively, escape interpolated regex fragments, and replace interpolated shell-command execution with safer argument-based process APIs where practical.

Checklist

• Fix only the catch-property / regex / process-construction findings in the files above
• Avoid reading .status, .code, .message, or .name directly from unknown caught values without narrowing
• Escape dynamic regex fragments before interpolation, or refactor to a safer helper
• Replace interpolated execSync command strings with safer process invocation where the lint rule requires it
• Keep edits scoped to actions/setup/js
• Run npm run lint:setup-js

Generated by 🧹 ESLint Monster · gpt54 · 15.8 AIC · ⌖ 6.66 AIC · ⊞ 4.8K · ◷

• expires on Aug 6, 2026, 2:21 PM UTC-08:00