clap-rs/clap: a workspace block every crate should inherit

clap's root Cargo.toml sets the license, edition, minimum Rust version, repository and lints once, and every member crate inherits them. A new crate with its own license would still pass CI. Five rules here check it, and every member passed.This config was written to test alint; clap doesn't use alint.

What alint found

.alint.yml

- id: clap-member-license-inherits
  kind: for_each_dir
  select: "{clap_builder,clap_derive,clap_complete,clap_complete_nushell,clap_lex,clap_mangen,clap_bench}"
  when_iter: 'iter.has_file("Cargo.toml")'
  require:
    - kind: toml_path_equals
      paths: "{path}/Cargo.toml"
      path: "$.package.license.workspace"
      equals: true
  level: error

✓ passed clap-member-license-inherits

Every member inherits its license, edition, minimum Rust version, repository and lints from the workspace. Five rules check one field each.

.alint.yml

extends:
  - alint://bundled/oss-baseline@v1
  - alint://bundled/ci/github-actions@v1

ℹ︎ info oss-security-policy-exists

There's no SECURITY.md, CODEOWNERS or code of conduct.

The bundled GitHub Actions rules (alint 0.16.1, on the workflows as of 7 May 2026) flag all 56 action references in the 9 workflows, which use a tag or branch, such as actions/checkout@v6, instead of a commit.

The config

clap is a small workspace: the clap crate at the root and seven members, such as clap_builder and clap_derive. The config checks the workspace block field by field, that every member inherits it, the crates.io fields each member publishes and the policy files, and keeps the minimum Rust version in step with CI. rustfmt, typos, cffconvert and cargo deny run from command_idempotent rules, and commits get Conventional Commits and fixup checks.

.alint.yml

- id: clap-msrv-coherent-across-ci
  kind: cross_file_value_equals
  source:
    file: Cargo.toml
    extract: { toml: "$.workspace.package['rust-version']" }
  targets:
    files: ".github/workflows/ci.yml"
    extract: { regex: 'rust:\s*"(\d+\.\d+)"\s*#\s*MSRV' }
  normalize: none
  allow_missing_target: false
  level: error

The minimum Rust version is written in the workspace block and again in CI, next to an # MSRV comment. This rule keeps the two equal.

What stays outside alint

What the Rust toolchain does stays with it:

building, testing and documenting the crates, and Clippy's lints;
the license and advisory checks in cargo deny, which the config runs but doesn't replace;
the regexes in release.toml's pre-release-replacements, which should match the files they edit. alint has no rule that checks a regex against another file.