[luoling8192]

Summary

This PR closes the gaps that a comparison with the LobeHub workflow found. It follows #1.

• Push events. The action lints the files that the push changed. Before, it linted the whole working directory, which costs many model calls on a large repository. A new branch is compared with the default branch.
• provider-config input. It writes a complete provider configuration in TOML. provider-endpoint writes one model with no other properties, so a rule that requests a model by alias or by capability cannot resolve it, and a model cannot get default parameters such as thinking = { type = "disabled" }.
• Runs without secrets. With provider-endpoint, an empty api-key skips the action with a notice. A Dependabot pull request is not a fork, but it has no access to secrets.
• Cost line. The summary states the rule runs, the cached runs, and the input and output tokens. Before, it stated the total tokens only.
• Suggestion: paragraph. js/no-mixed-layers-without-abstraction appends the suggestion to the message. The action moves it to the suggestion line.

Behavior

Event	Before	After
pull_request	Changed lines of the pull request.	No change.
push	Whole working directory.	Changed lines of the push, from GET /compare/{before}...{after}.
push that creates a branch	Whole working directory.	Changed lines against the default branch.
push that deletes a branch	Whole working directory.	No lint run.
Other events	Whole working directory.	No change.

Model resolution in alint treats size as a preference, so one model without a size resolves. A request by name and a required capability are hard conditions. That is why provider-endpoint stays as it is and provider-config covers the other cases.

Boundaries and risks

Boundary	Failure mode	Protection	Evidence or gap
provider-config and provider-endpoint together	Two sources of configuration.	The guard step fails with an error.	Not verified in CI.
Compare API	GitHub returns at most 300 files.	None. A larger push lints the first 300 files.	Known limit.
Keyless provider with provider-endpoint	The empty key skips the action.	Use provider-config, which has no such condition.	Stated in the README.
Real provider	The fixture rule does not call a model.	None.	Not verified. A run with a real provider key is necessary.

Verification

• pnpm test:run: 21 tests passed. New cases cover a push, a new branch, an event without changes, the Suggestion: paragraph, and the cost line.
• pnpm lint and pnpm typecheck: passed.
• pnpm build: dist/index.mjs matches the source.
• Local run of alint 0.7.3: alint config models show fixture/fixture-model printed the alias, the capability, the size, and the default parameters from the file that the action writes.
• The e2e job writes the same configuration through provider-config and runs the same command. It now lints the whole fixture and checks the outputs, because a pull request that does not change the fixture has no findings on changed lines.

🤖 Generated with Claude Code

[github-actions]

⚠️ alint · 1 warning

	Location	Rule	Finding
⚠️	test/fixture/src/add.ts:2	fixture/no-fixme	A FIXME note is in the changed code. 💡 Resolve the note or remove it.

_{Commit e04f066 · run · 1 rule run, 0 cached · 0 input / 0 output tokens}