Summary
no-core-setoutput-non-string treats expr.length as a reliably-numeric value and flags it, but it does not recognize other equally-reliable numeric member accesses. This produces a live false negative in the target corpus.
Evidence
nonStringKind special-cases only .length (no-core-setoutput-non-string.ts:30-32). A real unwrapped numeric member access ships today:
// actions/setup/js/close_entity_helpers.cjs:572
core.setOutput(numberOutputName, closedEntity.number);
closedEntity.number is a GitHub issue/PR number — always numeric — passed without String(...). The rule does not flag it because the property name is number, not length. Compare the sibling call two lines down that correctly uses a string (closedEntity.html_url).
Proposed refinement
Extend the .length-only member check to a small, curated allowlist of property names that are numeric with very high confidence: at minimum .size (Map/Set) and .number (GitHub entity numbers). Report the kind precisely (e.g. .number (number)).
Keep the allowlist conservative and documented — do NOT broaden to ambiguous names like .id (frequently a string in GitHub GraphQL) to preserve the rule's low-false-positive contract. Note in a code comment why each name is included and why .id is excluded.
Acceptance criteria
Filed by ESLint Refiner (2026-07-01). First review of no-core-setoutput-non-string; live target site confirmed in actions/setup/js. Not a duplicate of open issues 42188-42190 / 42015-42017 / 41962-41963.
Generated by 🤖 ESLint Refiner · 216.1 AIC · ⌖ 12.1 AIC · ⊞ 4.7K · ◷
Summary
no-core-setoutput-non-stringtreatsexpr.lengthas a reliably-numeric value and flags it, but it does not recognize other equally-reliable numeric member accesses. This produces a live false negative in the target corpus.Evidence
nonStringKindspecial-cases only.length(no-core-setoutput-non-string.ts:30-32). A real unwrapped numeric member access ships today:closedEntity.numberis a GitHub issue/PR number — always numeric — passed withoutString(...). The rule does not flag it because the property name isnumber, notlength. Compare the sibling call two lines down that correctly uses a string (closedEntity.html_url).Proposed refinement
Extend the
.length-only member check to a small, curated allowlist of property names that are numeric with very high confidence: at minimum.size(Map/Set) and.number(GitHub entity numbers). Report the kind precisely (e.g..number (number)).Keep the allowlist conservative and documented — do NOT broaden to ambiguous names like
.id(frequently a string in GitHub GraphQL) to preserve the rule's low-false-positive contract. Note in a code comment why each name is included and why.idis excluded.Acceptance criteria
core.setOutput("issue_number", closedEntity.number)is flagged, with aString(...)suggestion..sizeis likewise flagged..id(and other ambiguous names) remain unflagged, with a comment documenting the exclusion rationale..number,.size, and the excluded.id.Filed by ESLint Refiner (2026-07-01). First review of
no-core-setoutput-non-string; live target site confirmed in actions/setup/js. Not a duplicate of open issues 42188-42190 / 42015-42017 / 41962-41963.