Codacy ESLint ignores the project tsconfig, reporting 5 false positives

[amondnet]

Problem

Codacy's ESLint reports 5 High issues on scripts/release-mode.ts that the project's own lint run does not — bun run lint (@pleaseai/eslint-config) is clean, and bun run typecheck is clean.

Codacy pattern	Where
@typescript-eslint/no-unnecessary-condition ×3	the arg?.startsWith('--') guard, the value === undefined guard, the ?.tag ?? null catalog lookup
security/detect-object-injection	const arg = argv[i] — a numeric index into a readonly string[]
security/detect-non-literal-fs-filename	readFile(resolve(process.cwd(), args.catalog)) — the --catalog path, which is the CLI's entire purpose

Why they are false positives

tsconfig.json sets noUncheckedIndexedAccess: true, so argv[i] is string | undefined and catalog.projects[p]?.[v]?.tag is … | undefined. Every flagged condition is required by the type system. no-unnecessary-condition is type-aware, and Codacy is evidently running it against a tsconfig that does not carry that flag.

Applying Codacy's advice was tested directly and produces 7 type errors:

scripts/release-mode.ts(61,10): error TS18048: 'arg' is possibly 'undefined'.
scripts/release-mode.ts(64,16): error TS18048: 'arg' is possibly 'undefined'.
scripts/release-mode.ts(65,30): error TS18048: 'arg' is possibly 'undefined'.
scripts/release-mode.ts(65,45): error TS18048: 'arg' is possibly 'undefined'.
scripts/release-mode.ts(69,43): error TS18048: 'arg' is possibly 'undefined'.
scripts/release-mode.ts(126,19): error TS2532: Object is possibly 'undefined'.
scripts/release-mode.ts(126,19): error TS2532: Object is possibly 'undefined'.

The two security/* patterns come from eslint-plugin-security, which this project does not enable; both are the known heuristic false positives that plugin produces for array indexing and for any CLI that takes a path argument.

What to do

This is a scanner configuration defect, not a code defect. Options, in order of preference:

1. Point Codacy's ESLint at the repository's own config (Codacy → repository settings → Code patterns → ESLint → use the configuration file), so it inherits eslint.config.ts and the project's tsconfig. This also stops the two security/* patterns, which that config does not enable.
2. Disable the five patterns for this repository in Codacy's code-pattern settings.

Do not "fix" these in source: the three no-unnecessary-condition items can only be silenced by deleting null-safety the compiler requires, and an inline eslint-disable for them would assert something false about the code.

Context

Found while taking PR #8 to merge. The PR was merged with this check red by explicit decision — Codacy is not a required check on main, and every other check (SonarCloud quality gate, CI, cubic, Socket, codecov) passed.