Reference configs

NixOS/nixpkgs: two packages commit a Ruby bundler cache

Two nixpkgs packages commit Ruby's bundler cache, .bundle/, which none of its CI checks looks for. On the same run, one rule checked all 20,698 package directories under pkgs/by-name/ without Nix installed.This config was written to test alint; nixpkgs doesn't use alint.

What alint found

.alint.yml
extends:
  - alint://bundled/oss-baseline@v1
  - alint://bundled/ci/github-actions@v1
  - alint://bundled/hygiene/no-tracked-artifacts@v1
  - alint://bundled/tooling/editorconfig@v1

⚠︎ warning hygiene-no-ruby-bundler-cache

Two packages commit a bundler cache: pkgs/by-name/pt/pt/.bundle and pkgs/by-name/re/redis-dump/.bundle.

.alint.yml
- id: nixpkgs-by-name-prefix-dirs-have-package
  kind: for_each_dir
  select: "pkgs/by-name/*/*"
  require:
    - kind: file_exists
      paths: "{path}/package.nix"
  level: error

✓ passed nixpkgs-by-name-prefix-dirs-have-package

All 20,698 package directories under pkgs/by-name/ have their package.nix.

The bundled GitHub Actions rules (alint 0.16.1, on the workflows as of 7 May 2026) flag one of its 17 workflows, periodic-merge.yml, for declaring no permissions. The rest pin every action to a commit and limit the token.

The config

The config extends oss-baseline, ci/github-actions, hygiene/no-tracked-artifacts and tooling/editorconfig. Its own rules check the files nixpkgs's CI depends on, the .gitattributes markers on generated files and the pkgs/by-name/ layout. treefmt runs from a command_idempotent rule; the parse check and nixpkgs-vet run from command rules, since they need Nix.

.alint.yml
- id: nixpkgs-treefmt-idempotent
  kind: command_idempotent
  paths: ci/default.nix
  command: ["nix-build", "ci", "-A", "fmt.check"]
  timeout: 600
  level: error

treefmt runs nixfmt, actionlint, zizmor and the other formatters through Nix. alint runs the same check and fails when it would change a file.

Speed

In May 2026, the 72 rules that didn't call other tools, from the config as it was then, checked a 52,354-file checkout in 332 ms (alint 0.9.17), the check on every package directory included. Measured with hyperfine on a machine with 10 logical cores.

What stays outside alint

Everything that needs Nix to evaluate code stays with Nix:

  • evaluating every package against the base branch, and checking that each package.nix is a valid package function;
  • consistency with pkgs/top-level/all-packages.nix, and the schema tests for the maintainer and team lists;
  • the maintainers and licenses a package names. registry_paths_resolve can't read values out of Nix expressions;
  • whether a package directory's name matches its attribute name. No rule kind checks that, and alint has no bundled Nix ruleset.