facebook/react: a package pointing npm at the wrong folder

react-refresh's package.json sets repository.directory to packages/react, copied from a sibling package, so npm links to the wrong folder. One for_each_dir rule checks that field in every package; none of React's package checks looks at it.This config was written to test alint; React doesn't use alint.

What alint found

.alint.yml

- id: react-package-repository-directory-matches
  when: facts.is_yarn_v1 and facts.has_react_package
  kind: for_each_dir
  select: "packages/*"
  when_iter: 'iter.has_file("package.json")'
  require:
    - kind: json_path_matches
      paths: "{path}/package.json"
      path: "$.repository.directory"
      matches: '^packages/{basename}$'
      if_present: true
  level: warning

⚠︎ warning react-package-repository-directory-matches

packages/react-refresh/package.json sets repository.directory to packages/react. The rule expects each package to name its own directory.

.alint.yml

- id: react-copyright-header-src
  when: facts.is_yarn_v1 and facts.has_react_package
  kind: file_header
  paths:
    include:
      - "packages/*/src/**/*.js"
    exclude:
      - "packages/*/src/**/__tests__/**/__snapshots__/**"
      - "packages/*/src/**/*.snap"
      - "packages/react-devtools-shared/src/hooks/__tests__/__source__/**"
  pattern: |-
    ^/\*\*
     \* Copyright \(c\) Meta Platforms, Inc\. and affiliates\.
     \*
     \* This source code is licensed under the MIT license found in the
  level: warning

⚠︎ warning react-copyright-header-src

Seven source files still carry the older "Meta Platforms, Inc. and its affiliates" header, such as packages/react/src/ReactCacheClient.js.

The bundled GitHub Actions rules (alint 0.16.1, on the workflows as of 8 May 2026) flag 164 action references not pinned to a commit, such as actions/checkout@v4.

The config

React is a Yarn 1 workspace of 39 packages, 21 of them published. The config checks what each package's package.json should say, the Meta copyright header, the config files CI depends on and the format of codes.json. It extends oss-baseline, node, monorepo, ci/github-actions, hygiene/no-tracked-artifacts and tooling/editorconfig, and runs ESLint, Prettier and Flow from command rules. Each rule starts with when: facts.is_yarn_v1 and facts.has_react_package: two facts at the top of the config check for a Yarn 1 workspace with a packages/react, and in a tree without them the rules stay quiet.

.alint.yml

- id: react-version-cross-file-equal
  when: facts.is_yarn_v1 and facts.has_react_package
  kind: cross_file_value_equals
  source:
    file: packages/shared/ReactVersion.js
    extract:
      regex: "export default '([^']+)';"
  targets:
    - file: packages/react/package.json
      extract: { json: "$.version" }
    - file: packages/react-dom/package.json
      extract: { json: "$.version" }
    - file: packages/react-test-renderer/package.json
      extract: { json: "$.version" }
  level: error

version-check.js becomes one rule: the version ReactVersion.js exports must equal the version in the three published manifests.

What stays outside alint

Anything that reads JavaScript as code stays with React's tools:

the five custom ESLint rules, which work on the syntax tree;
Flow, Jest and the build lint, which need a type checker, a test run or built bundles;
Danger, which reviews each pull request;
matching every error thrown in the source with an entry in codes.json, which needs React's extractor and a build.