fix(setup-js): wrap all sync fs calls in try/catch (eslint-monster remediation)

actions/setup/js/action_setup_otlp.cjs

@@ -40,7 +40,11 @@ const { getActionInput } = require("./action_input_utils.cjs");
  */
 function writeEnvLine(filePath, key, value, logLabel, fileLabel) {
   if (!filePath || !value) return;
-  appendFileSync(filePath, `${key}=${value}\n`);
+  try {
+    appendFileSync(filePath, `${key}=${value}\n`);
+  } catch {
+    /* ignore */
+  }
   console.log(`[otlp] ${logLabel} written to ${fileLabel}`);
 }
 

actions/setup/js/apply_safe_outputs_replay.cjs

@@ -70,7 +70,11 @@ function parseRunUrl(runUrl) {
 async function downloadAgentArtifact(runId, destDir, repoSlug) {
   core.info(`Downloading agent artifact from run ${runId}...`);
 
-  fs.mkdirSync(destDir, { recursive: true });
+  try {
+    fs.mkdirSync(destDir, { recursive: true });
+  } catch (err) {
+    throw new Error(`Failed to create directory ${destDir}: ${String(err)}`, { cause: err });
+  }
 
   const args = ["run", "download", runId, "--name", "agent", "--dir", destDir];
   if (repoSlug) {
@@ -99,7 +103,12 @@ async function downloadAgentArtifact(runId, destDir, repoSlug) {
  * @returns {Object} Handler config keyed by normalized type name
  */
 function buildHandlerConfigFromOutput(agentOutputFile) {
-  const content = fs.readFileSync(agentOutputFile, "utf8");
+  let content;
+  try {
+    content = fs.readFileSync(agentOutputFile, "utf8");
+  } catch (err) {
+    throw new Error(`Failed to read file ${agentOutputFile}: ${String(err)}`, { cause: err });
+  }
   let validatedOutput;
   try {
     validatedOutput = JSON.parse(content);

actions/setup/js/apply_samples.cjs

@@ -64,7 +64,7 @@
   try {
     parsed = JSON.parse(raw);
   } catch (err) {
     throw new Error(`${ERR_PARSE}: apply_samples: failed to parse GH_AW_SAMPLES as JSON: ${getErrorMessage(err)}`);
   }
   // Tolerate a literal JSON `null` payload (older compiler emitted it for
   // workflows with --use-samples but no `samples:` entries). Treat as empty.
@@ -94,7 +94,7 @@
  */
 function runGit(args, cwd) {
   const { spawnSync } = require("child_process");
   const result = spawnSync("git", args, { cwd, encoding: "utf8" });
   if (result.status !== 0) {
     throw new Error(`${ERR_SYSTEM}: git ${args.join(" ")} failed (exit ${result.status}): ${result.stderr || result.stdout}`);
   }
@@ -400,7 +400,11 @@
 
   // Write patch to a temp file and apply it.
   const tmpPatch = path.join(os.tmpdir(), `gh-aw-sample-${index + 1}.patch`);
-  fs.writeFileSync(tmpPatch, patch.endsWith("\n") ? patch : patch + "\n");
+  try {
+    fs.writeFileSync(tmpPatch, patch.endsWith("\n") ? patch : patch + "\n");
+  } catch (err) {
+    throw new Error(`Failed to write file ${tmpPatch}: ${String(err)}`, { cause: err });
+  }
   try {
     runGit(["apply", "--whitespace=nowarn", tmpPatch], repoCwd);
   } catch (err) {
@@ -440,7 +444,7 @@
     try {
       return JSON.parse(line);
     } catch (err) {
       throw new Error(`${ERR_PARSE}: apply_samples: failed to parse MCP JSON-RPC response for request id=${request.id}: ${getErrorMessage(err)} (line: ${line})`);
     }
   }
 }
@@ -536,7 +540,11 @@
     }),
     "",
   ];
-  fs.appendFileSync(logPath, lines.join("\n"));
+  try {
+    fs.appendFileSync(logPath, lines.join("\n"));
+  } catch {
+    /* ignore */
+  }
 }
 
 async function main() {

actions/setup/js/artifact_client.cjs

@@ -70,7 +70,7 @@
   if (!url) {
     throw new Error("ACTIONS_RESULTS_URL is required for artifact upload");
   }
   return new URL(url).origin;
 }
 
 async function twirpRequest(method, body) {
@@ -78,7 +78,7 @@
   if (!runtimeToken) {
     throw new Error("ACTIONS_RUNTIME_TOKEN is required for artifact upload");
   }
   const url = new URL(`/twirp/${TWIRP_ARTIFACT_SERVICE}/${method}`, getResultsServiceOrigin()).toString();
 
   let lastError;
   for (let attempt = 1; attempt <= DEFAULT_RETRY_ATTEMPTS; attempt++) {
@@ -160,14 +160,14 @@
 }
 
 function ensureZipAvailable() {
   const result = spawnSync("zip", ["-v"], { stdio: "ignore" });
   if (result.status !== 0) {
     throw new Error("zip command is required to upload artifacts (for example: apt-get install zip)");
   }
 }
 
 function ensureUnzipAvailable() {
   const result = spawnSync("unzip", ["-v"], { stdio: "ignore" });
   if (result.status !== 0) {
     throw new Error("unzip command is required to download artifacts (for example: apt-get install unzip)");
   }
@@ -282,7 +282,11 @@
     }
 
     const destination = options.path || process.env.GITHUB_WORKSPACE || process.cwd();
-    fs.mkdirSync(destination, { recursive: true });
+    try {
+      fs.mkdirSync(destination, { recursive: true });
+    } catch (err) {
+      throw new Error(`Failed to create directory ${destination}: ${String(err)}`, { cause: err });
+    }
 
     const apiUrl = new URL(`/repos/${findBy.repositoryOwner}/${findBy.repositoryName}/actions/artifacts/${artifactId}/zip`, process.env.GITHUB_API_URL || "https://api.github.com");
     const redirectResponse = await fetch(apiUrl.toString(), {

actions/setup/js/build_checkout_manifest.cjs

@@ -97,7 +97,11 @@ function buildCheckoutManifest(entries, options = {}) {
   // $RUNNER_TEMP/gh-aw that is bind-mounted into the containerized safe-outputs
   // MCP server, which is where the manifest is read by findRepoCheckout.
   const manifestDir = path.join(runnerTemp, "gh-aw", "safeoutputs");
-  fs.mkdirSync(manifestDir, { recursive: true });
+  try {
+    fs.mkdirSync(manifestDir, { recursive: true });
+  } catch (err) {
+    throw new Error(`Failed to create directory ${manifestDir}: ${String(err)}`, { cause: err });
+  }
   const manifestPath = path.join(manifestDir, "checkout-manifest.json");
   const manifest = {};
   core.info(`checkout-manifest: building manifest for ${entries.length} checkout entries`);
@@ -127,7 +131,11 @@ function buildCheckoutManifest(entries, options = {}) {
     core.info(`checkout-manifest: ${repository} -> path=${checkoutPath} default_branch=${defaultBranch || "<unresolved>"}`);
   }
 
-  fs.writeFileSync(manifestPath, JSON.stringify(manifest, null, 2) + "\n", "utf8");
+  try {
+    fs.writeFileSync(manifestPath, JSON.stringify(manifest, null, 2) + "\n", "utf8");
+  } catch (err) {
+    throw new Error(`Failed to write file ${manifestPath}: ${String(err)}`, { cause: err });
+  }
   core.info(`checkout-manifest written to ${manifestPath}`);
   return { manifestPath, manifest };
 }

actions/setup/js/check_workflow_recompile_needed.cjs

@@ -107,7 +107,12 @@ async function filterFilesNeedingUpdate(comparisonRef, changedFiles, workspaceDi
   const filesToUpdate = [];
   for (const file of changedFiles) {
     const workingTreePath = `${workspaceDir}/${file}`;
-    const workingTreeContent = fs.readFileSync(workingTreePath, "utf8");
+    let workingTreeContent;
+    try {
+      workingTreeContent = fs.readFileSync(workingTreePath, "utf8");
+    } catch (err) {
+      throw new Error(`Failed to read file ${workingTreePath}: ${String(err)}`, { cause: err });
+    }
     const { stdout, exitCode } = await exec.getExecOutput("git", ["show", `${comparisonRef}:${file}`], {
       ignoreReturnCode: true,
     });

actions/setup/js/convert_gateway_config_shared.cjs

@@ -154,8 +154,12 @@ function logServerStats(servers, includedCount) {
  * @param {string} output
  */
 function writeSecureOutput(outputPath, output) {
-  fs.mkdirSync(path.dirname(outputPath), { recursive: true });
-  fs.writeFileSync(outputPath, output, { mode: 0o600 });
+  try {
+    fs.mkdirSync(path.dirname(outputPath), { recursive: true });
+    fs.writeFileSync(outputPath, output, { mode: 0o600 });
+  } catch (err) {
+    throw new Error(`Failed to write file ${outputPath}: ${String(err)}`, { cause: err });
+  }
   fs.chmodSync(outputPath, 0o600);
 }
 

actions/setup/js/copilot_harness.cjs

@@ -658,7 +658,11 @@ function writeCopilotOutputs(results) {
     `model_not_supported_error=${results.modelNotSupportedError}`,
     `http_400_response_error=${results.http400ResponseError}`,
   ];
-  fs.appendFileSync(outputFile, lines.join("\n") + "\n");
+  try {
+    fs.appendFileSync(outputFile, lines.join("\n") + "\n");
+  } catch {
+    /* ignore */
+  }
 }
 
 /**

actions/setup/js/create_code_scanning_alert.cjs

@@ -86,7 +86,11 @@ async function main(config = {}) {
       ],
     };
 
-    fs.writeFileSync(sarifFilePath, JSON.stringify(sarifContent, null, 2));
+    try {
+      fs.writeFileSync(sarifFilePath, JSON.stringify(sarifContent, null, 2));
+    } catch (err) {
+      throw new Error(`Failed to write file ${sarifFilePath}: ${String(err)}`, { cause: err });
+    }
     core.info(`✓ Updated SARIF file with ${validFindings.length} finding(s): ${sarifFilePath}`);
   }
 

actions/setup/js/create_pull_request.cjs

@@ -1143,7 +1143,11 @@ async function main(config = {}) {
       let patchContent = "";
       let isEmpty = true;
       if (hasPatchFile) {
-        patchContent = fs.readFileSync(patchFilePath, "utf8");
+        try {
+          patchContent = fs.readFileSync(patchFilePath, "utf8");
+        } catch (err) {
+          throw new Error(`Failed to read file ${patchFilePath}: ${String(err)}`, { cause: err });
+        }
         isEmpty = !patchContent || !patchContent.trim();
       }
 
@@ -1341,7 +1345,12 @@ async function main(config = {}) {
         }
 
         if (patchFilePath && fs.existsSync(patchFilePath)) {
-          const patchStats = fs.readFileSync(patchFilePath, "utf8");
+          let patchStats;
+          try {
+            patchStats = fs.readFileSync(patchFilePath, "utf8");
+          } catch (err) {
+            throw new Error(`Failed to read file ${patchFilePath}: ${String(err)}`, { cause: err });
+          }
           if (patchStats.trim()) {
             summaryContent += `**Changes:** Patch file exists with ${patchStats.split("\n").length} lines\n\n`;
             summaryContent += `<details><summary>Show patch preview</summary>\n\n\`\`\`diff\n${patchStats.slice(0, 2000)}${patchStats.length > 2000 ? "\n... (truncated)" : ""}\n\`\`\`\n\n</details>\n\n`;
@@ -1841,7 +1850,11 @@ gh pr create --title '${title}' --base ${baseBranch} --head ${getPullRequestHead
             patchContent = replaceTemporaryIdReferencesInPatch(patchContent, tempIdMap, itemRepo);
             if (patchContent !== originalPatchContent) {
               core.info("Resolved temporary ID references in patch content");
-              fs.writeFileSync(patchFilePath, patchContent, "utf8");
+              try {
+                fs.writeFileSync(patchFilePath, patchContent, "utf8");
+              } catch (err) {
+                throw new Error(`Failed to write file ${patchFilePath}: ${String(err)}`, { cause: err });
+              }
             }
           }
 
@@ -2075,7 +2088,12 @@ gh pr create --title '${title}' --base ${baseBranch} --head ${getPullRequestHead
                 // Read patch content for preview
                 let patchPreview = "";
                 if (patchFilePath && fs.existsSync(patchFilePath)) {
-                  const patchContent = fs.readFileSync(patchFilePath, "utf8");
+                  let patchContent;
+                  try {
+                    patchContent = fs.readFileSync(patchFilePath, "utf8");
+                  } catch (err) {
+                    throw new Error(`Failed to read file ${patchFilePath}: ${String(err)}`, { cause: err });
+                  }
                   patchPreview = generatePatchPreview(patchContent);
                 }
 
@@ -2586,7 +2604,12 @@ ${patchPreview}`;
           // Read patch content for preview
           let patchPreview = "";
           if (patchFilePath && fs.existsSync(patchFilePath)) {
-            const patchContent = fs.readFileSync(patchFilePath, "utf8");
+            let patchContent;
+            try {
+              patchContent = fs.readFileSync(patchFilePath, "utf8");
+            } catch (err) {
+              throw new Error(`Failed to read file ${patchFilePath}: ${String(err)}`, { cause: err });
+            }
             patchPreview = generatePatchPreview(patchContent);
           }
 
@@ -2646,7 +2669,12 @@ ${patchPreview}`;
         // Read patch content for preview
         let patchPreview = "";
         if (patchFilePath && fs.existsSync(patchFilePath)) {
-          const patchContent = fs.readFileSync(patchFilePath, "utf8");
+          let patchContent;
+          try {
+            patchContent = fs.readFileSync(patchFilePath, "utf8");
+          } catch (err) {
+            throw new Error(`Failed to read file ${patchFilePath}: ${String(err)}`, { cause: err });
+          }
           patchPreview = generatePatchPreview(patchContent);
         }
 

actions/setup/js/daily_aic_workflow_helpers.cjs

@@ -138,7 +138,12 @@ function sumAICFromUsageJSONLFiles(filePaths) {
       continue;
     }
 
-    const content = fs.readFileSync(filePath, "utf8");
+    let content;
+    try {
+      content = fs.readFileSync(filePath, "utf8");
+    } catch (err) {
+      throw new Error(`Failed to read file ${filePath}: ${String(err)}`, { cause: err });
+    }
     if (!content.trim()) {
       continue;
     }

actions/setup/js/detect_agent_errors.cjs

@@ -175,14 +175,22 @@ function writeOutputs(results) {
   }
 
   const lines = buildOutputLines(results);
-  fs.appendFileSync(outputFile, lines.join("\n") + "\n");
+  try {
+    fs.appendFileSync(outputFile, lines.join("\n") + "\n");
+  } catch {
+    /* ignore */
+  }
 }
 
 function main() {
   let logContent = "";
 
   if (fs.existsSync(LOG_FILE)) {
-    logContent = fs.readFileSync(LOG_FILE, "utf8");
+    try {
+      logContent = fs.readFileSync(LOG_FILE, "utf8");
+    } catch (err) {
+      throw new Error(`Failed to read file ${LOG_FILE}: ${String(err)}`, { cause: err });
+    }
   } else {
     process.stderr.write(`[detect-agent-errors] Log file not found: ${LOG_FILE}\n`);
   }