[luoling8192]

Summary

A repository that runs alint in CI must write its own steps to install the CLI, select the changes of a pull request, and show the result. This PR adds a composite action that does these steps.

- uses: actions/checkout@v6
- uses: alint-dev/setup@main
  with:
    provider-endpoint: https://api.openai.com/v1
    provider-model: gpt-5.4-mini
    api-key: ${{ secrets.OPENAI_API_KEY }}

The action publishes a check run with line annotations, one summary comment that each run rewrites, and a job summary. It replaces alint-dev/alint#94, which put the publication logic in the CLI.

Change map

Module	Responsibility
action.yml	Skips fork pull requests, installs alint, writes the provider configuration, installs plugins, restores .alintcache, and runs the bundle.
src/main.ts	Reads the environment, selects the scope, runs alint, and publishes.
src/changes.ts	Converts the patches of the pull request files to changed line ranges and filters diagnostics.
src/lint.ts, src/output.ts	Run alint --format json and validate the output with Valibot.
src/findings.ts	Converts diagnostics to findings, annotations, and the Markdown summary. Pure functions.
src/github.ts	Calls the GitHub REST API.
dist/index.mjs	The committed bundle. CI fails when it does not match the source.

Behavior

flowchart LR
  E[Event] -->|files input| F[Lint the files, keep each finding]
  E -->|pull request| P[GET pulls/N/files]
  P --> C[Lint the changed files, keep findings on changed lines]
  E -->|other event| W[Lint the working directory]
  F & C & W --> R[Check run, job summary, outputs]
  R -->|pull request| S[Rewrite the summary comment]

Loading

• The changed lines come from the GitHub API, so a shallow checkout is sufficient and the action does not move HEAD.
• On a pull request, the check run goes to the head commit. GITHUB_SHA is the temporary merge commit there.
• The check run conclusion is failure for an error, neutral for warnings only, and success for no findings. The step fails only when alint exits with 2 or GitHub rejects a request.
• A file without a patch from GitHub (binary or very large diff) keeps each finding.

Boundaries and risks

Boundary	Failure mode	Protection	Evidence or gap
Fork pull requests	No secrets and a read-only token.	The guard step skips with a notice.	Not verified. This repository is private and has no forks.
Annotation limit	GitHub accepts 50 annotations for each request.	Batches of 50.	main.test.ts with 120 diagnostics
Summary size	GitHub rejects a body above 65536 characters.	The table has at most 100 rows.	findings.test.ts
Line numbers	The default checkout is the merge commit. Its line numbers can differ from the head commit when the base branch changed the same file.	None.	Known limit.
Provider configuration	alint setup writes one model without an alias or a size. A rule that requests a model by size can fail to resolve it.	None.	Not verified. The fixture rule does not call a model. A run with a real provider key is necessary.
Real GitHub API	A local server in the tests does not prove that GitHub accepts the payload.	The e2e job runs the action on this pull request.	See the alint (fixture) check and the summary comment on this pull request.

Verification

• pnpm test:run: 17 tests passed. main.test.ts runs the full flow against a local HTTP server and a program that stands in for alint. It uses no mocks.
• pnpm typecheck: passed.
• pnpm lint: passed.
• pnpm build: wrote dist/index.mjs.
• alint 0.7.3 on test/fixture/src/add.ts: reported the fixture/no-fixme warning on line 2.

🤖 Generated with Claude Code

[github-actions]

⚠️ alint · 1 warning

	Location	Rule	Finding
⚠️	test/fixture/src/add.ts:2	fixture/no-fixme	A FIXME note is in the changed code. 💡 Resolve the note or remove it.

_{Commit 83899e7 · run · 0 tokens}