Fix sync exec timeout detection for defaulted option spreads

[Copilot]

require-sync-exec-timeout treated any options-object spread as sufficient, missing same-file wrappers where a defaulted options parameter was spread into execFileSync without any caller-provided timeout.

• ESLint rule

  • Detects defaulted function-parameter spreads such as execOptions = {}.
  • Checks direct same-file helper call sites for a positive timeout.
  • Keeps unresolved or external spreads conservative to avoid false positives.

• Regression coverage

  • Adds RuleTester cases for the wrapper-closure false negative.
  • Verifies unresolved exported wrappers still pass.

• Manifest hardening

  • Adds explicit setup timeout values to build_checkout_manifest.cjs git and gh lookups.

const runGit = (args, execOptions = {}) =>
  execFileSync("git", args, { encoding: "utf8", ...execOptions });

runGit(["status"], { stdio: "pipe" }); // now reported: no timeout

• Fixes require-sync-exec-timeout: options-object built entirely from a spread parameter with no timeout anywhere silently escapes detec #54735

[github-actions]

PR Triage

• Category: chore
• Risk: low
• Priority score: 30/100 (impact 10, urgency 5, quality 15)
• Recommended action: defer
• CI status: pending

Generated by 🔧 PR Triage Agent · auto · 82.9 AIC · ⌖ 6.65 AIC · ⊞ 8.3K · ◷

[github-actions]

Great work on this fix! 🎯 This PR closes a significant gap in the require-sync-exec-timeout rule where wrapper functions with defaulted options parameters were bypassing the timeout check.

Summary of Changes:
The PR enhances the ESLint rule to detect when options-object spreads come from function parameters with literal defaults (like execOptions = {}). Previously, the rule conservatively assumed any spread meant the timeout was potentially supplied. Now it:

• Traces spread arguments to their parameter definitions
• Checks whether the parameter default has a timeout
• Analyzes all direct call sites to verify timeout is supplied at the caller
• Keeps conservative behavior for unresolved/external spreads

Coverage:

• ✅ Rule enhancement — 170 lines of new helper functions for static analysis
• ✅ Regression tests — 7 new test cases covering the wrapper-closure pattern and false positive avoidance
• ✅ Manifest hardening — 6 lines adding explicit timeouts to build_checkout_manifest.cjs where the rule now correctly flags missing timeouts

This is ready for review. 🟢

Generated by ✅ Contribution Check · auto · 51 AIC · ⌖ 5.08 AIC · ⊞ 9.2K · ◷

[github-actions]

PR Triage

Category: chore | Risk: low | Priority: low | Score: 25/100
Recommended action: defer

Draft. Fixes lint rule detection gap for require-sync-exec-timeout. Small (206/12, 4 files). No CI runs yet.

_{Automated triage — run 32572524009}

Generated by 🔧 PR Triage Agent · auto · 65.4 AIC · ⌖ 6.04 AIC · ⊞ 8.3K · ◷