Installation

alint ships as a single native executable with no language runtime, no JVM, and nothing else to install. Pick whichever path matches your environment.

Homebrew (macOS + Linuxbrew)

brew tap asamarts/alint
brew install alint

The recommended path on macOS and Linux. The asamarts/homebrew-alint tap is auto-updated on every release; the formula resolves the matching pre-built tarball for your platform, verifies its SHA-256, and installs to the Homebrew cellar.

install.sh (Linux + macOS)

curl -sSL https://alint.org/install.sh | bash

Detects platform (Linux / macOS, x86_64 / aarch64), downloads the matching tarball from GitHub Releases, verifies its SHA-256, and installs to $INSTALL_DIR (default ~/.local/bin). This path is shell-based, so it does not cover Windows; Windows users have npm, cargo, or the manual tarball (see Windows).

Pin a specific version (and skip the “latest release” GitHub API lookup, which can rate-limit on shared CI egress IPs):

ALINT_VERSION=v0.16.1 curl -sSL https://alint.org/install.sh | bash

Supply-chain note: the installer verifies the SHA-256 of the release tarball it downloads, but the script itself is fetched from the main branch (alint.org/install.sh redirects there). To pin the installer too, point curl at a release tag instead of main (for example https://raw.githubusercontent.com/asamarts/alint/v0.16.1/install.sh), or download it from the Releases page and review it before running.

npm

npm install -g @asamarts/alint

The @asamarts/alint package is a thin wrapper: on install it downloads the platform-matched native binary from GitHub Releases and verifies its SHA-256. Handy in Node/JS projects and CI that already have npm. Zero-install works too:

npx @asamarts/alint check

Supports Linux (x64/arm64), macOS (x64/arm64), and Windows (x64). The install runs a postinstall script, so it needs network access at install time and does not work under npm install --ignore-scripts, Bun’s bunx, or pnpm 10+ (which blocks dependency build scripts by default — run pnpm approve-builds @asamarts/alint to allow it). A future release moves to per-platform packages to lift those limits.

PyPI (uvx / pipx / pip / uv)

# Run without installing (the Python equivalent of npx):
uvx alint check
pipx run alint check

# Install as a standalone tool:
uv tool install alint
pipx install alint

# Or into the current environment:
pip install alint

The alint PyPI package ships the native binary inside a per-platform wheel (py3-none-<platform>): no source build, no PyO3, no Python in the hot path. It is the same executable the other channels ship, delivered through the Python packaging ecosystem. Because the wheel embeds the binary rather than downloading it in a postinstall step, it installs cleanly where the npm wrapper cannot: locked-down --ignore-scripts-style installs, offline/mirror setups, and bunx. Convenient for Python-tooling repos, pre-commit, and any environment that already has uv or pipx.

Supports Linux (x86_64/aarch64, glibc and musl), macOS (x86_64/arm64), and Windows (x64). Python 3.7+ is enough to select a wheel; the binary itself is interpreter-independent.

cargo

cargo install alint

Builds from source against the current stable Rust toolchain (requires rustc 1.85+ and cargo on $PATH). To install a pre-built binary instead of compiling, use cargo-binstall:

cargo binstall alint

cargo binstall attempts to fetch a pre-built release tarball (verifying its checksum) instead of compiling, falling back to a source build if it cannot resolve one — much faster on CI and low-powered machines when the pre-built path is taken.

Docker / Podman

A distroless multi-arch image (linux/amd64, linux/arm64) is published to ghcr.io on each release:

# Lint the current directory:
docker run --rm -v "$PWD:/repo" ghcr.io/asamarts/alint:latest

# Pin to an exact version:
docker run --rm -v "$PWD:/repo" ghcr.io/asamarts/alint:v0.16.1 check

The image is OCI-standard, so Podman runs it unchanged — just use the fully-qualified name (Podman does not assume a default registry):

podman run --rm -v "$PWD:/repo" ghcr.io/asamarts/alint:latest check

The image runs as the distroless nonroot user (UID 65532); host files must be world-readable. To apply fixes and preserve host ownership, pass -u:

docker run --rm -u $(id -u):$(id -g) -v "$PWD:/repo" ghcr.io/asamarts/alint:latest fix

Also published: the bare semver (:0.16.1), the :<major>.<minor> rolling channel, and the raw git tag (:v0.16.1).

Windows

The install.sh one-liner is shell-based and does not cover Windows. On Windows, use:

• npm: npm install -g @asamarts/alint (see npm) — the simplest path;
• cargo: cargo install alint or cargo binstall alint (see cargo);
• manual: download alint-v0.16.1-x86_64-pc-windows-msvc.tar.gz from the Releases page, extract, and put alint.exe on your PATH.

Note on manually-downloaded binaries: a tarball downloaded through a browser carries a “mark of the web”, so the first run can trip Windows SmartScreen (“More info → Run anyway”) or, on macOS, Gatekeeper quarantine — clear it with xattr -d com.apple.quarantine ./alint. Binaries fetched by curl/npm/cargo/Homebrew/Docker carry no such mark and run without prompts.

Enterprise mirror / offline install

Air-gapped setups can install without direct github.com access:

• Docker: re-tag and push the image into your internal registry, then pull from there.
• npm: once a future release ships per-platform packages, point .npmrc registry= at your internal mirror; today the postinstall wrapper fetches from github.com.
• cargo: use a source replacement mirror for the from-source build.

From source

git clone https://github.com/asamarts/alint
cd alint
cargo build --release -p alint
./target/release/alint --help

Useful when you want to track main between releases or are contributing patches.

Verify the install

alint --version

Should print alint <version> matching the channel you installed from.

Verify the release signature and provenance

From the release that introduced signing onward, every release is cosign-signed and carries GitHub build provenance, so you can confirm a download was built by alint’s CI from alint’s source before you trust it. install.sh does this automatically when cosign is present (best-effort: it never blocks the install, and you can opt out with ALINT_SKIP_VERIFY=1). To verify by hand:

# Build provenance, with the GitHub CLI:
gh attestation verify alint-<version>-<target>.tar.gz --repo asamarts/alint

# Signature over the checksum manifest, with cosign v3+ (no GitHub account needed):
cosign verify-blob --bundle SHA256SUMS.cosign.bundle \
  --certificate-identity-regexp '^https://github\.com/asamarts/alint/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  SHA256SUMS
# then confirm your downloaded tarball is one of the signed entries:
sha256sum --check --ignore-missing SHA256SUMS   # macOS: shasum -a 256 --check --ignore-missing SHA256SUMS

See SECURITY.md for the full set (the container image signature, macOS notes, and prerequisites).

Uninstall

alint’s footprint is the binary itself (no managed config or data directory), plus — only if you used remote extends: rulesets — a cache under your platform cache dir (~/.cache/alint/ on Linux). Remove the binary with whatever installed it: brew uninstall alint, npm uninstall -g @asamarts/alint, cargo uninstall alint, or for install.sh, rm ~/.local/bin/alint; delete the cache dir too if you used remote rulesets.