hcl_path_absent

Assert a JSONPath query over the document matches nothing; one file-level violation if present.

Semantics:

The query must select zero nodes. Any match fires exactly one violation for the file — never per-match, so a $[?…] filter that fans out over every top-level key still yields a single violation.
The existence sibling of the value-checking kinds; mirrors file_absent for a path. equals / matches / if_present don’t apply.
Useful for forbidding a key: a postinstall script in package.json, a [patch] table in Cargo.toml, or write-all permissions in a workflow.

Options

Option	Type	Required	Default	Description
`path`	string	yes		`JSONPath` expression rooted at `$`. The rule fires one violation per file if the query matches any node (the path must be absent).

Plus the common paths, level, id, and when fields. This table is generated from the JSON Schema; option types and defaults are authoritative.

Example

A Terraform provider with a hardcoded credential

The rule fires on this repository:

main.tf

provider "aws" {
  region     = "us-east-1"
  access_key = "AKIAIOSFODNN7EXAMPLE"
}

With this .alint.yml:

version: 1
rules:
  - id: no-hardcoded-key
    kind: hcl_path_absent
    paths: "main.tf"
    path: "$.provider.aws.access_key"
    level: error
    message: >-
      A hardcoded access_key is in a .tf file; use a variable or the provider chain.

alint check reports:

--- main.tf --------------------------------------------------------------------
  x  error    no-hardcoded-key
              A hardcoded access_key is in a .tf file; use a variable or the
              provider chain.

Summary (1 violation):
  x 1 error
  0 passing * 1 failing

A Terraform provider with no hardcoded credential

This repository is compliant:

main.tf

provider "aws" {
  region = "us-east-1"
}