eslint-factory: require-error-code-in-thrown-error false-positives on error-code identifiers embedded after an underscore #52643

Rule: require-error-code-in-thrown-error

Gap (currently live false positive): ERROR_CODE_PATTERN = (berr/redacted)[A-Z_]+\b|\bE[0-9]{3}\b/ (eslint-factory/src/rules/require-error-code-in-thrown-error.ts:12) relies on \b word-boundary matching to find an embedded E<digits> code. But _ is a \w character, so when a 3-digit code constant is embedded at the end of a larger SAFE_OUTPUT_<CODE>-style identifier (e.g. SAFE_OUTPUT_E099), there is no word boundary immediately before the E — \bE[0-9]{3}\b cannot match E099 inside SAFE_OUTPUT_E099, and it also doesn't start with ERR_ so the first alternative doesn't match either. messageReferencesErrorCode therefore reports missingErrorCode on throws that already embed a correctly-imported error-code constant.

Grounded live false positives (all import an error_codes.cjs-style SAFE_OUTPUT_E0NN constant and reference it inside a template literal, which the rule inspects via TemplateLiteral.expressions):

• actions/setup/js/dismiss_pull_request_review.cjs:249 — throw new Error(`${SAFE_OUTPUT_E099}: Failed to fetch review ${reviewId} on ${owner}/${repo}#${pullRequestNumber}: ${getErrorMessage(getReviewError)}`, { cause: getReviewError })
• actions/setup/js/add_labels.cjs:365
• actions/setup/js/comment_memory.cjs:41
• actions/setup/js/merge_pull_request.cjs:71
• actions/setup/js/merge_pull_request.cjs:184

All five are genuinely compliant (the message is fully coded), but the rule flags them anyway — the exact opposite of the previously-fixed "USE-001" conformance work (#51018, #27700) that added these codes in the first place.

Ask:

1. Fix the boundary check so an embedded code is recognized regardless of what precedes it inside an identifier — e.g. anchor on the code pattern itself rather than a generic \b (/ERR_[A-Z_]+|E[0-9]{3}(?!\d)/ with an explicit check that the match isn't part of a longer lowercase word, or simply drop the leading \b since these constants are always upper-case-prefixed and won't collide with lowercase identifiers).
2. Add regression tests: throw new Error(`${SAFE_OUTPUT_E099}: ...`) and throw new Error(`${MY_PREFIX_ERR_CONFIG}: ...`) must be valid; a message with no such suffix must still be invalid.
3. Re-verify the five grounded sites above stop firing once the fix lands.

Generated by 🤖 ESLint Refiner · agent · 255.1 AIC · ⌖ 34.6 AIC · ⊞ 4.7K · ◷

• expires on Aug 20, 2026, 10:01 PM UTC-08:00