fix(lint): convert file-scope oxlint disables to per-call (batch 1)

11 files converted from file-scope `/* oxlint-disable socket/<rule> */`
to inline `oxlint-disable-next-line <rule> -- <reason>` per call site,
per the new socket/no-file-scope-oxlint-disable rule.

Several files were entirely `for...of` over non-array iterables
(Map.entries, Object.entries, destructured tuples) where the
prefer-cached-for-loop rule's autofix is unsafe; the new rule's per-
call disable shape carries the per-site reason next to each loop.

Files: scripts/util/{run-command,git-helpers,package}.mts,
.github/actions/lib/read-pinned-version.mts,
scripts/ci/{inline-action-versions-as-shas,generate-actions-allow-list}.mts,
scripts/lint.mts,
scripts/validation/npm-packages.mts (already clean after strip — emoji
not in the rule's denylist),
scripts/testing/validate-package-tests.mts (clean after strip; the
file-scope block was the 3 lines pushing it over the 500-line cap),
scripts/npm/{install-npm-packages,release-npm-packages}.mts (clean
after strip).

Author: jdalton

.github/actions/lib/read-pinned-version.mts

@@ -1,4 +1,3 @@
-/* oxlint-disable socket/prefer-cached-for-loop -- iterates non-array iterables (Object.entries); the cached-length rewrite would be incorrect. */
 /**
  * @file Print the pinned version of a Socket package to stdout, reading from
  *   (in order):
@@ -63,6 +62,7 @@ const fromPackageJson = (pkg: string): string | undefined => {
     return undefined
   }
   const json = JSON.parse(readFileSync('package.json', 'utf8'))
+  // oxlint-disable-next-line socket/prefer-cached-for-loop -- iterates a 2-element const tuple; cached-length form would obscure the literal pair.
   for (const field of ['dependencies', 'devDependencies'] as const) {
     const deps = json[field]
     if (deps && typeof deps[pkg] === 'string') {

scripts/ci/generate-actions-allow-list.mts

@@ -2,7 +2,6 @@
  * @file Generate GitHub Actions allow list from workflow and action
  *   dependencies.
  */
-/* oxlint-disable socket/prefer-cached-for-loop -- iterates non-array iterables (Map / Object.entries); the cached-length rewrite would be incorrect. */
 
 import { promises as fs } from 'node:fs'
 import path from 'node:path'
@@ -79,6 +78,7 @@ async function main(): Promise<void> {
   for (let i = 0, { length } = workflowFiles; i < length; i += 1) {
     const file = workflowFiles[i]
     const deps = await extractDependencies(file)
+    // oxlint-disable-next-line socket/prefer-cached-for-loop -- iterates Map.entries() (non-array iterable); cached-length would be incorrect.
     for (const { 0: key, 1: value } of deps.entries()) {
       allDependencies.set(key, value)
     }
@@ -98,6 +98,7 @@ async function main(): Promise<void> {
       )
       try {
         const deps = await extractDependencies(actionFile)
+        // oxlint-disable-next-line socket/prefer-cached-for-loop -- iterates Map.entries() (non-array iterable); cached-length would be incorrect.
         for (const { 0: key, 1: value } of deps.entries()) {
           allDependencies.set(key, value)
         }
@@ -109,6 +110,8 @@ async function main(): Promise<void> {
   const socketDevActions = []
   const externalActions = []
 
+  // oxlint-disable-next-line socket/prefer-cached-for-loop -- iterates Map.values() (non-array iterable); cached-length would be incorrect.
+
   for (const dep of allDependencies.values()) {
     if (dep.startsWith('SocketDev/')) {
       socketDevActions.push(dep)

scripts/ci/inline-action-versions-as-shas.mts

@@ -1,7 +1,6 @@
 /**
  * @file Convert GitHub Actions tags/branches to commit SHAs in workflow files.
  */
-/* oxlint-disable socket/prefer-cached-for-loop -- iterates `usesStatements.slice().reverse()` / non-array iterables; the cached-length rewrite would be incorrect or lose the reverse pass. */
 
 import { existsSync, promises as fs } from 'node:fs'
 import path from 'node:path'
@@ -131,6 +130,7 @@ export async function processFile(filePath, token, dryRun) {
   const changes = []
 
   // Process in reverse order to maintain correct string positions.
+  // oxlint-disable-next-line socket/prefer-cached-for-loop -- iterates a reversed slice; cached-length form would lose the reverse pass.
   for (const stmt of usesStatements.slice().reverse()) {
     const { fullMatch, indent, owner, ref: currentRef, repoPath } = stmt
 
@@ -269,6 +269,7 @@ async function main(): Promise<void> {
   }
 
   // Display changes.
+  // oxlint-disable-next-line socket/prefer-cached-for-loop -- destructured loop variable; cached-length rewrite would scatter the destructure.
   for (const { changes, file } of processedFiles) {
     logger.error('')
     logger.info(`${path.relative(cwd, file)}:`)

scripts/lint.mts

@@ -2,7 +2,6 @@
  * @file Unified lint runner with flag-based configuration. Provides smart
  *   linting that can target affected files or lint everything.
  */
-/* oxlint-disable socket/prefer-cached-for-loop -- iterates a configured linter list (destructured loop variable); the cached-length rewrite would be incorrect. */
 
 import { existsSync, readFileSync } from 'node:fs'
 import path from 'node:path'
@@ -188,6 +187,7 @@ export async function runLintOnFiles(
     },
   ]
 
+  // oxlint-disable-next-line socket/prefer-cached-for-loop -- destructured linter-config tuple; cached-length rewrite would scatter the destructure.
   for (const { args, enabled } of linters) {
     if (!enabled) {
       continue
@@ -260,6 +260,7 @@ export async function runLintOnAll(options: LintOptions = {}): Promise<number> {
     },
   ]
 
+  // oxlint-disable-next-line socket/prefer-cached-for-loop -- destructured linter-config tuple; cached-length rewrite would scatter the destructure.
   for (const { args } of linters) {
     const result = await runCommandQuiet('pnpm', args)
 

scripts/npm/install-npm-packages.mts

@@ -1,5 +1,3 @@
-/* oxlint-disable socket/no-status-emoji -- intentional emoji output. */
-/* oxlint-disable socket/prefer-cached-for-loop -- iterates Dirent results inside async tasks; the cached-length rewrite is unsafe under await chains. */
 /* max-file-lines: legitimate — monolithic npm-install driver (resolution + override application + nested traversal + progress UI). The phases share enough live state (tasks queue, override map, scoped-vs-unscoped branch) that splitting them produces a tangle of cross-file mutables. */
 
 /**

scripts/npm/release-npm-packages.mts

@@ -1,5 +1,3 @@
-/* oxlint-disable socket/no-status-emoji -- intentional emoji output. */
-/* oxlint-disable socket/prefer-cached-for-loop -- iterates non-array iterables (state.warnings / state.changes / Object.entries); the cached-length rewrite would be incorrect. */
 
 /**
  * @file Detect package changes and bump versions for npm release.

scripts/testing/validate-package-tests.mts

@@ -1,5 +1,3 @@
-/* oxlint-disable socket/no-status-emoji -- intentional emoji output. */
-/* oxlint-disable socket/prefer-cached-for-loop -- iterates destructured records and async-settled results; the cached-length rewrite would be incorrect. */
 
 /**
  * @file Validates package overrides before release to catch test infrastructure

scripts/util/git-helpers.mts

@@ -1,4 +1,3 @@
-/* oxlint-disable socket/no-process-cwd-in-scripts-hooks -- every exported helper accepts a `cwd` parameter the caller can override; the `process.cwd()` defaults are convenience for ad-hoc invocations and don't bypass the anchor-on-script-location rule. */
 /**
  * @file Git helper functions for listing staged / unstaged / changed files. All
  *   returned paths are relative to the git top-level, so downstream glob
@@ -79,6 +78,7 @@ export function filterRelativeToRoot(
 /**
  * Get changed files synchronously (paths relative to git root).
  */
+// oxlint-disable-next-line socket/no-process-cwd-in-scripts-hooks -- helper accepts cwd; process.cwd() is the ad-hoc-invocation default, not a bypass of the anchor-on-script-location rule.
 export function getChangedFilesSync(cwd = process.cwd()): string[] {
   try {
     const gitRoot = getGitRoot(cwd)
@@ -101,6 +101,7 @@ export function getChangedFilesSync(cwd = process.cwd()): string[] {
 /**
  * Get staged files (paths relative to git root).
  */
+// oxlint-disable-next-line socket/no-process-cwd-in-scripts-hooks -- helper accepts cwd; process.cwd() is the ad-hoc-invocation default, not a bypass of the anchor-on-script-location rule.
 export async function getStagedFiles(cwd = process.cwd()): Promise<string[]> {
   try {
     const gitRoot = await getGitRootAsync(cwd)
@@ -120,6 +121,7 @@ export async function getStagedFiles(cwd = process.cwd()): Promise<string[]> {
 /**
  * Get staged files synchronously (paths relative to git root).
  */
+// oxlint-disable-next-line socket/no-process-cwd-in-scripts-hooks -- helper accepts cwd; process.cwd() is the ad-hoc-invocation default, not a bypass of the anchor-on-script-location rule.
 export function getStagedFilesSync(cwd = process.cwd()): string[] {
   try {
     const gitRoot = getGitRoot(cwd)
@@ -142,6 +144,7 @@ export function getStagedFilesSync(cwd = process.cwd()): string[] {
 /**
  * Get unstaged files (paths relative to git root).
  */
+// oxlint-disable-next-line socket/no-process-cwd-in-scripts-hooks -- helper accepts cwd; process.cwd() is the ad-hoc-invocation default, not a bypass of the anchor-on-script-location rule.
 export async function getUnstagedFiles(cwd = process.cwd()): Promise<string[]> {
   try {
     const gitRoot = await getGitRootAsync(cwd)
@@ -161,6 +164,7 @@ export async function getUnstagedFiles(cwd = process.cwd()): Promise<string[]> {
 /**
  * Get unstaged files synchronously (paths relative to git root).
  */
+// oxlint-disable-next-line socket/no-process-cwd-in-scripts-hooks -- helper accepts cwd; process.cwd() is the ad-hoc-invocation default, not a bypass of the anchor-on-script-location rule.
 export function getUnstagedFilesSync(cwd = process.cwd()): string[] {
   try {
     const gitRoot = getGitRoot(cwd)
@@ -185,6 +189,7 @@ export function getUnstagedFilesSync(cwd = process.cwd()): string[] {
  */
 export async function isUnstaged(
   pathname: string,
+  // oxlint-disable-next-line socket/no-process-cwd-in-scripts-hooks -- multi-arg form: default for ad-hoc invocations only.
   cwd = process.cwd(),
 ): Promise<boolean> {
   const files = await getUnstagedFiles(cwd)
@@ -194,6 +199,7 @@ export async function isUnstaged(
 /**
  * Check if a file is unstaged synchronously.
  */
+// oxlint-disable-next-line socket/no-process-cwd-in-scripts-hooks -- helper accepts cwd; process.cwd() is the ad-hoc-invocation default, not a bypass of the anchor-on-script-location rule.
 export function isUnstagedSync(pathname: string, cwd = process.cwd()): boolean {
   const files = getUnstagedFilesSync(cwd)
   return files.includes(pathname)

scripts/util/package.mts

@@ -1,5 +1,4 @@
 /* max-file-lines: legitimate — shared package.json toolkit; every helper is co-consumed by multiple npm scripts and splitting would fan-out imports without a real domain seam (only ~22 LOC over the soft cap). */
-/* oxlint-disable socket/prefer-cached-for-loop -- iterates Object.entries() of script tables; the cached-length rewrite would be incorrect. */
 /**
  * @file Common utilities for working with package.json files. Provides helper
  *   functions for reading, updating, and managing package.json files across the
@@ -344,6 +343,7 @@ export async function installPackageForTesting(
 
       // Preserve test:* scripts and the exact key 'tests', but not unrelated
       // names like 'testsuite' that merely begin with 'tests'.
+      // oxlint-disable-next-line socket/prefer-cached-for-loop -- iterates Object.entries() (non-array iterable); cached-length would be incorrect.
       for (const { 0: key, 1: value } of Object.entries(originalScripts)) {
         if (
           (key.startsWith('test:') || key === 'tests') &&

scripts/util/run-command.mts

@@ -1,7 +1,6 @@
 /**
  * @file Utility for running shell commands with proper error handling.
  */
-/* oxlint-disable socket/prefer-cached-for-loop -- iterates a destructured command-list record; the cached-length rewrite would be incorrect. */
 
 import process from 'node:process'
 
@@ -79,6 +78,7 @@ export interface CommandSpec {
  * Run multiple commands in sequence, stopping on first failure.
  */
 export async function runSequence(commands: CommandSpec[]): Promise<number> {
+  // oxlint-disable-next-line socket/prefer-cached-for-loop -- destructured command-list record; the cached-length rewrite would lose the destructuring shape.
   for (const { args = [], command, options = {} } of commands) {
     // eslint-disable-next-line no-await-in-loop
     const exitCode = await runCommand(command, args, options)