yaml_path_absent

Assert a JSONPath query over the document matches nothing; one file-level violation if present.

Semantics:

The query must select zero nodes. Any match fires exactly one violation for the file — never per-match, so a $[?…] filter that fans out over every top-level key still yields a single violation.
The existence sibling of the value-checking kinds; mirrors file_absent for a path. equals / matches / if_present don’t apply.
Useful for forbidding a key: a postinstall script in package.json, a [patch] table in Cargo.toml, or write-all permissions in a workflow.

Options

Option	Type	Required	Default	Description
`path`	string	yes		`JSONPath` expression rooted at `$`. The rule fires one violation per file if the query matches any node (the path must be absent).

Plus the common paths, level, id, and when fields. This table is generated from the JSON Schema; option types and defaults are authoritative.

Example

A workflow that grants write-all to the GITHUB_TOKEN

The rule fires on this repository:

.github/
.github/workflows/
.github/workflows/ci.yml

name: CI
on: push
permissions: write-all
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - run: echo hi

With this .alint.yml:

version: 1
rules:
  - id: no-write-all-token
    kind: yaml_path_absent
    paths: ".github/workflows/*.yml"
    path: "$[?($.permissions == 'write-all')]"
    level: error
    message: >-
      Workflow grants `write-all` to the GITHUB_TOKEN; restrict it to
      `contents: read` (or narrower).

alint check reports:

--- .github/workflows/ci.yml ---------------------------------------------------
  x  error    no-write-all-token
              Workflow grants `write-all` to the GITHUB_TOKEN; restrict it to
              `contents: read` (or narrower).

Summary (1 violation):
  x 1 error
  0 passing * 1 failing

A workflow that restricts the token to read

This repository is compliant:

.github/
.github/workflows/
.github/workflows/ci.yml

name: CI
on: push
permissions:
  contents: read
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - run: echo hi