fix: workaround eslint issue without resorting to run_shell

example/test/BUILD.bazel

@@ -1,7 +1,19 @@
 "Demonstrates how to enforce zero-lint-tolerance policy with tests"
 
+load("@aspect_rules_ts//ts:defs.bzl", "ts_project")
 load("//tools:lint.bzl", "eslint_test", "flake8_test", "pmd_test")
 
+ts_project(
+    name = "no_violations",
+    srcs = ["no_violations.ts"],
+    tsconfig = {},
+)
+
+eslint_test(
+    name = "eslint_empty_report",
+    srcs = [":no_violations"],
+)
+
 flake8_test(
     name = "flake8",
     srcs = ["//src:unused_import"],

example/test/no_violations.ts

@@ -0,0 +1 @@
+export const a = "this is fine";

lint/BUILD.bazel

@@ -1,7 +1,14 @@
+load("@aspect_rules_js//js:defs.bzl", "js_library")
 load("@bazel_skylib//:bzl_library.bzl", "bzl_library")
 
 exports_files(glob(["*.bzl"]) + ["lint_test.sh"])
 
+js_library(
+    name = "eslint.workaround_17660",
+    srcs = ["eslint.workaround_17660.js"],
+    visibility = ["//visibility:public"],
+)
+
 bzl_library(
     name = "buf",
     srcs = ["buf.bzl"],

lint/eslint.bzl

@@ -31,6 +31,10 @@ def eslint_action(ctx, executable, srcs, report, use_exit_code = False):
 
     args = ctx.actions.args()
 
+    # Workaround: create an empty report file in case eslint doesn't write one
+    # Use `../../..` to return to the execroot?
+    args.add_joined(["--node_options", "--require", "../../../" + ctx.file._workaround_17660.path], join_with = "=")
+
     # require explicit path to the eslintrc file, don't search for one
     args.add("--no-eslintrc")
 
@@ -47,7 +51,7 @@ def eslint_action(ctx, executable, srcs, report, use_exit_code = False):
 
     # Add the config file along with any deps it has on npm packages
     inputs.extend(js_lib_helpers.gather_files_from_js_providers(
-        [ctx.attr._config_file],
+        [ctx.attr._config_file, ctx.attr._workaround_17660],
         include_transitive_sources = True,
         include_declarations = False,
         include_npm_linked_packages = True,
@@ -60,15 +64,10 @@ def eslint_action(ctx, executable, srcs, report, use_exit_code = False):
         outputs.append(exit_code_out)
         env["JS_BINARY__EXIT_CODE_OUTPUT_FILE"] = exit_code_out.path
 
-    ctx.actions.run_shell(
-        inputs = inputs + [executable._eslint],
+    ctx.actions.run(
+        inputs = inputs,
         outputs = outputs,
-        # Workaround https://github.com/eslint/eslint/issues/17660
-        # If the output wasn't created, then put empty file there.
-        command = "./{eslint} $@; [ -f {output} ] || touch {output}".format(
-            eslint = executable._eslint.path,
-            output = report.path,
-        ),
+        executable = executable._eslint,
         arguments = [args],
         env = env,
         mnemonic = "ESLint",
@@ -112,5 +111,10 @@ def eslint_aspect(binary, config):
                 default = config,
                 allow_single_file = True,
             ),
+            "_workaround_17660": attr.label(
+                default = "@aspect_rules_lint//lint:eslint.workaround_17660",
+                allow_single_file = True,
+                cfg = "exec",
+            ),
         },
     )

lint/eslint.workaround_17660.js

@@ -0,0 +1,9 @@
+// Workaround for https://github.com/eslint/eslint/issues/17660
+// Use as a --require script so that this script is evaluated before the eslint entry point.
+// Creates an empty report file just in case eslint doesn't try to write one.
+const fs = require("fs");
+for (let i = 0; i < process.argv.length; i++) {
+  if (process.argv[i] == "--output-file") {
+    fs.closeSync(fs.openSync(process.argv[i + 1], "w"));
+  }
+}