[eslint-monster] actions/setup/js input parsing and boundary validation lint slice

[github-actions]

Summary

Daily npm run lint:setup-js surfaced a focused input parsing and validation slice across actions/setup/js. This group clusters missing guards around numeric parsing, dates, JSON/URL parsing, and request/response error boundaries.

Affected files

• actions/setup/js/add_reaction_and_edit_comment.cjs
• actions/setup/js/add_workflow_run_comment.cjs
• actions/setup/js/artifact_client.cjs
• actions/setup/js/awf_reflect.cjs
• actions/setup/js/check_daily_aic_workflow_guardrail.cjs
• actions/setup/js/check_rate_limit.cjs
• actions/setup/js/check_runs_helpers.cjs
• actions/setup/js/create_prompt.cjs
• actions/setup/js/data_schema_normalizer.cjs
• actions/setup/js/evaluate_outcomes.cjs
• actions/setup/js/exchange_otlp_workload_identity.cjs
• actions/setup/js/fuzz_template_substitution_harness.cjs
• actions/setup/js/generate_usage_activity_summary.cjs
• actions/setup/js/handle_noop_message.cjs
• actions/setup/js/memory_custom_validation.cjs
• actions/setup/js/notify_comment_error.cjs
• actions/setup/js/push_repo_memory.cjs
• actions/setup/js/safe-outputs-mcp-server.cjs

Representative diagnostics

• add_reaction_and_edit_comment.cjs:267 — gh-aw-custom/require-nan-check-after-split-index-parse
• check_rate_limit.cjs:46 — gh-aw-custom/require-nan-check-after-env-numeric-parse
• check_runs_helpers.cjs:43 — gh-aw-custom/require-invalid-date-check-before-compare
• data_schema_normalizer.cjs:155 — gh-aw-custom/require-json-parse-try-catch
• exchange_otlp_workload_identity.cjs:34 — gh-aw-custom/require-fetch-try-catch
• artifact_client.cjs:299 — gh-aw-custom/require-fetch-response-body-try-catch

Expected outcome

Add validation and try/catch coverage around parsed numeric/date/JSON/URL inputs and fetch/response body operations so malformed inputs and transient I/O failures surface clearly instead of propagating as uncaught runtime errors.

Remediation checklist

• Keep changes scoped to actions/setup/js parsing, validation, and request-boundary logic only.
• Validate numeric values parsed from env vars or split strings before downstream use.
• Guard date parsing before relational comparisons.
• Wrap JSON parsing, new URL(...), fetch(...), response body reads, and sync temp-file creation in targeted try/catch blocks with preserved context.
• Run npm run lint:setup-js as the final validation.

Copilot instructions

1. Focus on adding the smallest safe guards needed to satisfy the reported rules.
2. Preserve existing APIs and behavior except for clearer failure handling.
3. Reuse existing helper/error patterns in nearby files where possible.
4. Do not broaden scope beyond the listed validation and boundary issues.

Generated by 🧹 ESLint Monster · gpt54 · 17 AIC · ⌖ 6.58 AIC · ⊞ 5.5K · ◷

• expires on Aug 28, 2026, 2:03 PM UTC-08:00

[github-actions]

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster · gpt54 · 2.55 AIC · ⌖ 8.62 AIC · ⊞ 11.7K · ◷