Enforce syntax-aware linting for bundled CommonJS action scripts

Makefile

@@ -837,8 +837,9 @@ validate-cjs-syntax:
 
 # Lint JavaScript (.cjs and .js) and JSON files in actions/setup/js directory
 .PHONY: lint-cjs
-lint-cjs: fmt-check-cjs validate-cjs-syntax
-	@echo "✓ JavaScript formatting validated"
+lint-cjs: fmt-check-cjs validate-cjs-syntax check-node-version
+	@cd eslint-factory && { [ -d node_modules ] || npm ci; } && npm run lint:setup-js
+	@echo "✓ JavaScript formatting, syntax, and lint validated"
 
 # Lint JSON files in pkg directory (excluding actions/setup/js, which is handled by npm script)
 .PHONY: lint-json

eslint-factory/src/commonjs-syntax.test.ts

@@ -0,0 +1,31 @@
+import { Linter } from "eslint";
+import { describe, expect, it } from "vitest";
+
+const cjsConfig = {
+  languageOptions: {
+    ecmaVersion: "latest" as const,
+    sourceType: "commonjs" as const,
+  },
+};
+
+describe("CommonJS syntax validation", () => {
+  it("rejects await inside non-async functions", () => {
+    const linter = new Linter();
+    const messages = linter.verify(`function writeStepSummaryWithTokenUsage(coreObj) { await coreObj.summary.write(); }`, cjsConfig, "parse_mcp_gateway_log.cjs");
+
+    expect(messages).toContainEqual(
+      expect.objectContaining({
+        fatal: true,
+        ruleId: null,
+        severity: 2,
+      })
+    );
+  });
+
+  it("allows await inside async functions", () => {
+    const linter = new Linter();
+    const messages = linter.verify(`async function writeStepSummaryWithTokenUsage(coreObj) { await coreObj.summary.write(); }`, cjsConfig, "parse_mcp_gateway_log.cjs");
+
+    expect(messages).toEqual([]);
+  });
+});