dotenv_path_absent

Assert a JSONPath query over the document matches nothing; one file-level violation if present.

Semantics:

The query must select zero nodes. Any match fires exactly one violation for the file — never per-match, so a $[?…] filter that fans out over every top-level key still yields a single violation.
The existence sibling of the value-checking kinds; mirrors file_absent for a path. equals / matches / if_present don't apply.
Useful for forbidding a key: a postinstall script in package.json, a [patch] table in Cargo.toml, or write-all permissions in a workflow.

Options

Option	Type	Required	Default	Description
`path`	string	yes		`JSONPath` expression rooted at `$`. The rule fires one violation per file if the query matches any node (the path must be absent).

Plus the common paths, level, id, when, scope_filter, fix, and expect_matches fields. This table is generated from the JSON Schema; option types and defaults are authoritative.

Example

A .env that commits an AWS secret

The rule fires on this repository:

.env
✗ error no-committed-secret
A secret is committed in .env; move it to a secrets manager and keep .env out of version control.

NODE_ENV=production
AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMIexampleKEY

With this .alint.yml:

version: 1
rules:
  - id: no-committed-secret
    kind: dotenv_path_absent
    paths: ".env"
    path: "$.AWS_SECRET_ACCESS_KEY"
    level: error
    message: >-
      A secret is committed in .env; move it to a secrets manager and keep
      .env out of version control.

alint check reports:

--- .env -----------------------------------------------------------------------
  x  error    no-committed-secret
              A secret is committed in .env; move it to a secrets manager and
              keep .env out of version control.

Summary (1 violation):
  x 1 error
  0 passing * 1 failing

A .env with no committed secret

This repository is compliant:

.env✓

NODE_ENV=production
PORT=8080