denoland/deno: the checks in Deno's lint script, as rules

Deno's tools/lint.js runs Clippy and dlint plus seven checks of its own, such as a fixed list of top-level entries and a clippy.toml in every crate. This config checks 4 of them as rules, next to a copyright check for every language.This config was written to test alint; Deno doesn't use alint.

What alint found

The bundled GitHub Actions rules (alint 0.16.1, on the workflows as of 7 May 2026) flag 8 of the 11 generated workflows for declaring no permissions, and ci.generated.yml for granting contents: write at the workflow level.

The config

Deno is a Rust core with JavaScript and TypeScript tooling around it, in crates under cli/, ext/, libs/ and runtime/. The config checks the copyright line in Rust, JavaScript, TypeScript, C and Cargo manifests, the files allowed at the top level, a clippy.toml in every crate and that the generated workflows are current. dprint, dlint and Clippy run from command rules, and an import_gate rule flags imports of the filesystem functions the clippy.toml files ban.

.alint.yml

- id: deno-copyright-rust
  kind: file_header
  paths:
    include: ["**/*.rs"]
    exclude: ["ops/optimizer_tests/**"]
  scope_filter:
    has_ancestor: Cargo.toml
  pattern: '^// Copyright 2018-2026 the Deno authors\. MIT license\.'
  level: error

The copyright script's Rust check, as a file_header rule. The year is part of the pattern, as it is in Deno's own script (const copyrightYear = 2026), so both change each January. Four more rules cover JavaScript and TypeScript, C, Cargo manifests and the year in LICENSE.md.

.alint.yml

- id: deno-ext-crate-has-clippy-toml
  kind: for_each_dir
  select: "ext/*"
  when_iter: 'iter.has_file("Cargo.toml")'
  require:
    - kind: file_exists
      paths: "{path}/clippy.toml"
  level: error

Each crate's clippy.toml bans certain filesystem and environment calls. This rule and its twin for libs/ make sure every crate has one.

.alint.yml

- id: deno-ci-workflow-fresh
  kind: command_idempotent
  command: ["deno", "run", "--allow-read=.", ".github/workflows/ci.ts", "--lint"]
  level: error

Each workflow is generated from a TypeScript file. This rule runs the generator in check mode and fails when ci.generated.yml is out of date.

What stays outside alint

Checks that need a syntax tree or another tool's history stay in tools/:

capital short flags in the Rust CLI parser, and JSDoc tags, which need an AST;
the polyfill lint, which compares each file's violation count with a stored baseline. alint's baseline records its own findings, not another tool's counts;
whether every .out file in the test specs is still referenced by a test;
pull request title checks, release scripts and a CI optimization script.