json_path_absent

Assert a JSONPath query over the document matches nothing; one file-level violation if present.

Semantics:

The query must select zero nodes. Any match fires exactly one violation for the file — never per-match, so a $[?…] filter that fans out over every top-level key still yields a single violation.
The existence sibling of the value-checking kinds; mirrors file_absent for a path. equals / matches / if_present don't apply.
Useful for forbidding a key: a postinstall script in package.json, a [patch] table in Cargo.toml, or write-all permissions in a workflow.

Options

Option	Type	Required	Default	Description
`path`	string	yes		`JSONPath` expression rooted at `$`. The rule fires one violation per file if the query matches any node (the path must be absent).

Plus the common paths, level, id, when, scope_filter, fix, and expect_matches fields. This table is generated from the JSON Schema; option types and defaults are authoritative.

Example

A package.json that runs a postinstall script

The rule fires on this repository:

package.json
✗ error no-postinstall-script
package.json declares a `postinstall` script; these run automatically on `npm install` and are a common supply-chain foothold.

{
  "name": "demo",
  "version": "1.0.0",
  "scripts": {
    "postinstall": "node ./scripts/setup.js"
  }
}

With this .alint.yml:

version: 1
rules:
  - id: no-postinstall-script
    kind: json_path_absent
    paths: "package.json"
    path: "$.scripts.postinstall"
    level: error
    message: >-
      package.json declares a `postinstall` script; these run automatically
      on `npm install` and are a common supply-chain foothold.

alint check reports:

--- package.json ---------------------------------------------------------------
  x  error    no-postinstall-script
              package.json declares a `postinstall` script; these run
              automatically on `npm install` and are a common supply-chain
              foothold.

Summary (1 violation):
  x 1 error
  0 passing * 1 failing

A package.json with no lifecycle scripts

This repository is compliant:

package.json✓

{
  "name": "demo",
  "version": "1.0.0",
  "scripts": {
    "build": "tsc"
  }
}