Skip to content

LintLang 0.4.0 — SARIF and GitHub Code Scanning

Latest
Latest

Choose a tag to compare

View all tags
@roli-lpci roli-lpci released this 13 Aug 06:09
v0.4.0
43f5eb1
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

LintLang 0.4.0 adds deterministic SARIF 2.1.0 output for teams that want to bring LintLang's static agent-instruction findings into GitHub Code Scanning workflows.

What's new

  • lintlang scan --format sarif emits deterministic, schema-valid SARIF 2.1.0 on stdout.
  • Findings use stable LintLang rule IDs and repository-relative, URI-encoded artifact locations.
  • Python AST findings include evidence-supported line spans. YAML, JSON, text, and other structured findings stay honestly file-level when precise regions are unavailable.
  • The first-party composite Action adds an optional sarif-file input while preserving existing terminal behavior and fail-on exit semantics.
  • A copy-paste GitHub workflow shows least-privilege SARIF upload, including safe handling for failing lint verdicts, fork pull requests, and Dependabot pull requests.

Reliability and release integrity

  • Parser failures and repository-boundary errors no longer expose raw source evidence through SARIF notifications.
  • Windows parent traversal, out-of-repository paths, output/input collisions, and generated-report scan contamination are rejected or isolated.
  • CI and publication Actions are pinned to verified immutable commits.
  • Trusted publication now verifies the release tag against the package version and checked-out commit, then builds and checks both distributions before publishing to PyPI.
  • This release includes the post-0.3.8 fix that keeps quoted detector examples, inline and fenced code, and metalinguistic descriptions from triggering H2, H4, or H5 merely by mentioning detector phrases, while preserving findings for live directives and scope-classification failures.

Install

python -m pip install --upgrade lintlang==0.4.0

LintLang remains local, deterministic, zero-LLM, and zero-network by default. It statically inspects agent configs, tool definitions, prompts, and embedded Python prompt text; it does not evaluate runtime model behavior or certify production safety.

LintLang began as a Hermes Labs passion project. Thank you to everyone who has tested it, packaged it, added it to CI, or shared feedback as it has grown.

Assets 2
Loading