tensorflow/tensorflow: the checks that need no Bazel

Of the 9 tests in TensorFlow's full CI suite, 7 run Bazel. The ones that only look at files, such as tensorflow.org/code/ links that must point at real files, become rules here, next to checks on the 1,185 API goldens and the per-version lockfiles. This config was written to test alint; TensorFlow doesn't use alint.

The config

The public Python API is pinned by 1,185 golden files, which the API compatibility test diffs against the library. The config checks that the golden directories exist and carry the expected markers, that the tensorflow.org/code/ links resolve, and that the lockfiles for Python 3.10 to 3.13 pin the same numpy. buildifier, Pylint, clang-format, codespell and the API check run from command_idempotent rules.

.alint.yml

- id: tensorflow-org-code-links-resolve
  # fixed here: reads every file under tensorflow/, as the bats test does, and accepts directories
  kind: registry_paths_resolve
  source: "tensorflow/**"
  extract:
    regex: 'https://www\.tensorflow\.org/code/([a-zA-Z0-9/._-]+)'
  base: "."
  level: warning

One of the bats tests that don't need Bazel: each tensorflow.org/code/ link under tensorflow/, 79 of them in May, has to point at a file or directory that exists.

.alint.yml

- id: tensorflow-requirements-lock-numpy-parity
  # fixed here: leaves out Python 3.14, which requirements.in gives a newer numpy
  kind: cross_file_value_equals
  source:
    file: "requirements_lock_3_10.txt"
    extract:
      regex: '(?m)^numpy==([0-9][^ ;\\]+)'
  targets:
    - file: "requirements_lock_3_11.txt"
      extract: { regex: '(?m)^numpy==([0-9][^ ;\\]+)' }
    - file: "requirements_lock_3_12.txt"
      extract: { regex: '(?m)^numpy==([0-9][^ ;\\]+)' }
    - file: "requirements_lock_3_13.txt"
      extract: { regex: '(?m)^numpy==([0-9][^ ;\\]+)' }
  allow_missing_target: true
  level: warning

TensorFlow generates one lockfile per Python version from one requirements.in, which gives numpy a single range up to Python 3.13. Those four locks should pin the same numpy.

.alint.yml

- id: tensorflow-api-golden-v1-marker
  # fixed here: the top-level golden's path is "tensorflow" itself
  kind: file_content_matches
  paths: { include: ["tensorflow/tools/api/golden/v1/*.pbtxt"] }
  pattern: '(?m)^path:\s*"tensorflow[."]'
  level: warning

Each v1 golden records its API path on a path: line. The API test generates the goldens; this rule checks that they look right.

What stays outside alint

The Bazel checks and API diff stay in CI:

the bats tests that run Bazel: the license, dependency and CUDA checks on the pip package, the parse-only build and the query over every target;
the API compatibility test, which builds the Python library and diffs it against the goldens;
whether TFLite's bindings in Swift, Objective-C, Java and Python mirror the core API. Only code review checks that.