microsoft/vscode: a naming rule only a README states

VS Code's 172 proposed-API files are named vscode.proposed.<name>.d.ts, a pattern the directory's README documents but no script checks. One filename_regex rule does; on the run all 172 passed, and a Windows batch file turned up with LF endings.This config was written to test alint; VS Code doesn't use alint.

What alint found

.alint.yml

- id: vscode-dts-proposed-filename-grammar
  when: facts.has_vscode_dts
  kind: filename_regex
  paths:
    include:
      - "src/vscode-dts/vscode.proposed.*.d.ts"
  pattern: '^vscode\.proposed\.[a-zA-Z][a-zA-Z0-9]*\.d\.ts$'
  level: error

✓ passed vscode-dts-proposed-filename-grammar

All 172 proposed-API files in src/vscode-dts/ match. The README's pattern, vscode.proposed.[a-zA-Z]+.d.ts, allows letters only, but 5 names end in a digit, such as vscode.proposed.findFiles2.d.ts, so the rule allows digits after the first letter.

.alint.yml

- id: vscode-windows-bat-crlf
  when: facts.has_vscode_hygiene
  kind: line_endings
  paths:
    - "**/*.bat"
    - "**/*.cmd"
  target: crlf
  level: warning

⚠︎ warning vscode-windows-bat-crlf

build/azure-pipelines/win32/listprocesses.bat has LF line endings, although .gitattributes asks for CRLF.

The bundled GitHub Actions rules (alint 0.16.1, on the workflows as of 7 May 2026) flag 107 action references not pinned to a commit, and 4 reusable test workflows that declare no permissions of their own.

The config

Three of the hygiene checks become rules: the ban on the gallery key in product.json and the copyright header, as content rules, and the Copilot version check, as a cross_file rule. Three layering bans become import_gate rules, and ESLint, stylelint and hygiene.ts itself run from command rules. The rest are conventions nothing checked: the proposed-API file names, line endings in batch and shell files, the Component Governance manifests and strict mode in tsconfig.base.json.

.alint.yml

- id: vscode-copilot-engines-version-matches-root
  when: facts.has_copilot_ext
  kind: cross_file_value_equals
  source:
    file: "package.json"
    extract:
      json: "$.version"
  targets:
    - file: "extensions/copilot/package.json"
      extract:
        regex: '"vscode"\s*:\s*"\^([0-9]+\.[0-9]+\.[0-9]+)"'
  level: error

One of the hygiene checks: the Copilot extension's engines.vscode must be the root package version with a ^ in front.

.alint.yml

- id: vscode-layer-common-no-platform-reach
  when: facts.has_vscode_hygiene
  kind: import_gate
  language: js
  paths:
    include:
      - "src/vs/**/common/**/*.ts"
    exclude:
      - "src/vs/**/*.d.ts"
      - "src/vs/**/*.test.ts"
  forbid: '(^|/)(node|electron-browser|electron-main|electron-utility)/'
  allow:
    - 'vs/nls.js'
    - 'vs/amdX.js'
  level: warning

Code under common/ may not reach into node or electron layers. That's one of the bans that apply to a whole layer; the per-file allowlist in VS Code's layering rule stays in ESLint.

Speed

In the May run, on a checkout of 14,514 files, the rules that don't call other tools took 156 ms. Measured with hyperfine on a machine with 10 logical cores.

What stays outside alint

What needs the TypeScript syntax tree or VS Code's own printer stays in its tools:

the 45 custom ESLint rules, stylelint, and the formatting check, which uses the repository's own TypeScript printer;
the Unicode and indentation checks. alint's file_is_ascii has no per-line opt-out comment, and indent_style can't skip JSDoc continuation lines;
the generated per-file allowlist in code-import-patterns, which is more than a ban on a whole layer.