Fix sync exec timeout detection for defaulted option spreads

[Copilot]

require-sync-exec-timeout treated any options-object spread as sufficient, missing same-file wrappers where a defaulted options parameter was spread into execFileSync without any caller-provided timeout.

• ESLint rule

  • Detects defaulted function-parameter spreads such as execOptions = {}.
  • Checks direct same-file helper call sites for a positive timeout.
  • Keeps unresolved or external spreads conservative to avoid false positives.

• Regression coverage

  • Adds RuleTester cases for the wrapper-closure false negative.
  • Verifies unresolved exported wrappers still pass.

• Manifest hardening

  • Adds explicit setup timeout values to build_checkout_manifest.cjs git and gh lookups.

const runGit = (args, execOptions = {}) =>
  execFileSync("git", args, { encoding: "utf8", ...execOptions });

runGit(["status"], { stdio: "pipe" }); // now reported: no timeout

• Fixes require-sync-exec-timeout: options-object built entirely from a spread parameter with no timeout anywhere silently escapes detec #54735

[github-actions]

PR Triage

• Category: chore
• Risk: low
• Priority score: 30/100 (impact 10, urgency 5, quality 15)
• Recommended action: defer
• CI status: pending

Generated by 🔧 PR Triage Agent · auto · 82.9 AIC · ⌖ 6.65 AIC · ⊞ 8.3K · ◷

[github-actions]

Great work on this fix! 🎯 This PR closes a significant gap in the require-sync-exec-timeout rule where wrapper functions with defaulted options parameters were bypassing the timeout check.

Summary of Changes:
The PR enhances the ESLint rule to detect when options-object spreads come from function parameters with literal defaults (like execOptions = {}). Previously, the rule conservatively assumed any spread meant the timeout was potentially supplied. Now it:

• Traces spread arguments to their parameter definitions
• Checks whether the parameter default has a timeout
• Analyzes all direct call sites to verify timeout is supplied at the caller
• Keeps conservative behavior for unresolved/external spreads

Coverage:

• ✅ Rule enhancement — 170 lines of new helper functions for static analysis
• ✅ Regression tests — 7 new test cases covering the wrapper-closure pattern and false positive avoidance
• ✅ Manifest hardening — 6 lines adding explicit timeouts to build_checkout_manifest.cjs where the rule now correctly flags missing timeouts

This is ready for review. 🟢

Generated by ✅ Contribution Check · auto · 51 AIC · ⌖ 5.08 AIC · ⊞ 9.2K · ◷

[github-actions]

PR Triage

Category: chore | Risk: low | Priority: low | Score: 25/100
Recommended action: defer

Draft. Fixes lint rule detection gap for require-sync-exec-timeout. Small (206/12, 4 files). No CI runs yet.

_{Automated triage — run 32572524009}

Generated by 🔧 PR Triage Agent · auto · 65.4 AIC · ⌖ 6.04 AIC · ⊞ 8.3K · ◷

[Copilot]

Pull request overview

Improves sync child-process timeout detection for local wrappers and hardens checkout manifest commands.

Changes:

• Analyzes defaulted options spreads and same-file call sites.
• Adds regression coverage.
• Applies configured timeouts to git and gh lookups.

Show a summary per file

File	Description
eslint-factory/src/rules/require-sync-exec-timeout.ts	Adds wrapper call-site analysis.
eslint-factory/src/rules/require-sync-exec-timeout.test.ts	Adds spread-wrapper cases.
actions/setup/js/build_checkout_manifest.cjs	Adds command timeouts.
actions/setup/js/build_checkout_manifest.test.cjs	Verifies timeout propagation.

Review details

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

Suppressed comments (2)

eslint-factory/src/rules/require-sync-exec-timeout.ts:234

• The parameter default is being treated as if it applied to every invocation. In JavaScript, a caller such as runGit(args, {}) replaces a default { timeout: 5000 }, so this early return misses a real timeout-free call; an omitted argument should instead inspect the default. Evaluate the actual argument per direct call and use the default object only when that call omits it or passes an unshadowed undefined.

  if (hasPositiveTimeoutProperty(defaultObject.objectExpression)) return true;

eslint-factory/src/rules/require-sync-exec-timeout.ts:240

• The binding can be reassigned, but calls after that reassignment are still attributed to this wrapper. For example, let runGit = wrapper; runGit = external; runGit(args, {}) makes this rule report the original wrapper even though it is never invoked. Keep this analysis conservative by rejecting bindings with non-initializer writes before collecting their direct calls.

  const binding = getFunctionBindingVariable(containingFunction, sourceCode);
  if (!binding) return null;

  const directCalls = getDirectCalls(binding);

• Files reviewed: 4/4 changed files
• Comments generated: 1
• Review effort level: Balanced