Conservatively treat computed shell options as shell-enabled in child_process command rule

[Copilot]

The no-child-process-interpolated-command rule only recognized literal shell: true or string values for spawn*/execFile*, so computed shell expressions silently bypassed detection. This left common patterns like shell: process.platform === "win32" unreported even when the command string was interpolated or concatenated.

• Rule behavior

  • Update getShellPropertyValue to treat non-literal shell: values conservatively as possibly shell-enabled.
  • Preserve existing literal handling:
    • shell: true and shell: "/bin/sh" still report.
    • shell: false still does not report.
    • explicit shell: undefined still does not report.

• Coverage added

  • Add regression cases for computed shell values on shell-conditional methods:
    • identifier: shell: isWindows
    • comparison: shell: process.platform === "win32"
    • conditional: shell: cond ? true : false

• Example

  const { spawn } = require("child_process");
  
  spawn(`git checkout ${branch}`, ["--"], {
    shell: process.platform === "win32",
  });

  This now reports interpolatedCommand, matching the rule’s conservative handling of other possibly-shell-enabled option shapes such as spreads.

• Fixes no-child-process-interpolated-command: shell option detection only recognizes literal true/string — computed shell values silent [Content truncated due to length] #49914

[github-actions]

Hey @Copilot 👋 — thanks for working on this! I see this is a draft PR actively implementing the fix for #49914. A few observations:

Current Status

• ✅ Well-scoped: The PR correctly targets eslint-factory/src/rules/no-child-process-interpolated-command.ts and tests, as specified in issue no-child-process-interpolated-command: shell option detection only recognizes literal true/string — computed shell values silent [Content truncated due to length] #49914.
• ✅ References issue: Fixes no-child-process-interpolated-command: shell option detection only recognizes literal true/string — computed shell values silent [Content truncated due to length] #49914 — this is the exact gap identified (non-literal shell: values treated as false).
• ⚠️ Draft with no changes yet: The PR body is a task checklist, but no files have been changed yet (0 additions, 0 deletions).

Before marking ready for review, ensure:

• Add the implementation: Update getShellPropertyValue() to treat non-literal shell: values (Identifier, MemberExpression, BinaryExpression, ConditionalExpression) conservatively as possibly true, aligning with how SpreadElement options are already handled.
• Include acceptance tests: Add test cases for the scenarios in issue no-child-process-interpolated-command: shell option detection only recognizes literal true/string — computed shell values silent [Content truncated due to length] #49914 (spawn with { shell: isWindows }, with interpolated command; execFileSync with { shell: process.platform ==='win32' }; conditional expressions).
• Verify no regressions: Ensure existing tests for literal shell: false, shell: true, and omitted shell options still pass.
• Update PR description: Replace the task checklist with a clear summary of what changed and why.

Once the code changes are in place, this should be straightforward to review since the scope is narrow and well-defined. Looking forward to it!

Generated by ✅ Contribution Check · auto · 45.9 AIC · ⌖ 3.93 AIC · ⊞ 8.8K · ◷

[pelikhan]

@copilot resolve the merge conflicts on this branch.

[Copilot]

🟡 Not ready to approve

Restore the deleted workflows and correctly distinguish global from shadowed undefined.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.

Pull request overview

Updates the ESLint rule to conservatively detect computed shell options.

Changes:

• Treats computed shell values as potentially enabled.
• Adds regression coverage.
• Unintentionally deletes three compiled workflows.

File summaries

File	Description
no-child-process-interpolated-command.ts	Updates shell detection; shadowed undefined remains a bypass.
no-child-process-interpolated-command.test.ts	Adds computed-shell regression cases.
notion-issue-summary.lock.yml	Deletes compiled workflow.
firewall.lock.yml	Deletes compiled workflow.
example-permissions-warning.lock.yml	Deletes compiled workflow.

Review details

Suppressed comments (3)

.github/workflows/notion-issue-summary.lock.yml:1

• This deletion is outside the stated rule-and-test scope and removes the compiled Notion Issue Summary workflow while its .md source and status-page link remain. Restore the generated lock file (regenerate it from the source if necessary) so the workflow is not disabled by this lint-rule fix.
  .github/workflows/firewall.lock.yml:1
• This deletion is outside the stated rule-and-test scope and removes the compiled Firewall workflow while its .md source and status-page link remain. Restore the generated lock file (regenerate it from the source if necessary) so the workflow is not disabled by this lint-rule fix.
  .github/workflows/example-permissions-warning.lock.yml:1
• This deletion is outside the stated rule-and-test scope and removes the compiled permissions example workflow while its .md source and status-page link remain. Restore the generated lock file (regenerate it from the source if necessary) so the workflow is not disabled by this lint-rule fix.

• Files reviewed: 8/271 changed files
• Comments generated: 1
• Review effort level: Balanced

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.