yaml_path_matches

Same shape as the *_equals variants, but the asserted value is a regex matched against string values. Non-string matches produce a clear “value is not a string” violation.

Options

Option	Type	Required	Default	Description
`if_present`	boolean		`false`	When true, a query returning zero matches is silently OK - only real matches that fail the op produce violations.
`matches`	string	yes		Rust-regex pattern to match against the value at `path`.
`path`	string	yes		`JSONPath` expression rooted at `$`.

Plus the common paths, level, id, and when fields. This table is generated from the JSON Schema; option types and defaults are authoritative.

Example

A workflow action pinned to a floating tag

The rule fires on this repository:

.github/
.github/workflows/
.github/workflows/bad.yml
.github/workflows/ok.yml

name: Bad
on: push
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: echo hi

name: OK
on: push
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b
      - run: echo hi

With this .alint.yml:

version: 1
rules:
  - id: pin-actions-to-sha
    kind: yaml_path_matches
    paths: ".github/workflows/*.yml"
    path: "$.jobs.*.steps[*].uses"
    matches: '^[a-zA-Z0-9._/-]+@[a-f0-9]{40}$'
    level: warning

alint check reports:

--- .github/workflows/bad.yml --------------------------------------------------
  !  warning  pin-actions-to-sha
              value at path "actions/checkout@v4" does not match regex
              ^[a-zA-Z0-9._/-]+@[a-f0-9]{40}$

Summary (1 violation):
  ! 1 warning
  0 passing * 1 failing

Every workflow action is pinned to a commit SHA

This repository is compliant:

.github/
.github/workflows/
.github/workflows/ci.yml

name: CI
on: push
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b
      - uses: actions/setup-node@1a4442cacd436585916779262731d5b162bc6ec7
      - run: echo hi