LintLangGitHub Actions #
Check agent instructions on pull requests and pushes, then bring findings into GitHub Code Scanning with SARIF. LintLang can generate the workflow for an existing input in your repository.
Setup #
Install the CLI, enable Actions for the repository, and choose a committed instruction file or supported directory. From the repository root:
lintlang init --github --path AGENTS.md
Review .github/workflows/lintlang.yml before committing it. The generated workflow runs on pull requests and pushes to main; adjust the branch if needed. The released initializer pins the LintLang v0.7.0 Action by immutable commit, separately from the current CLI package.
The maintained complete workflow is the reference for adapting scan, artifact, and upload jobs. An existing different workflow is preserved: the initializer will refuse to overwrite it. Use --force only after reviewing the changes you intend to replace.
Verify #
lintlang scan AGENTS.md --fail-on fail
git status --short
Inspect the generated YAML's path, triggers, pins, and permissions. The local scan checks your current installed scanner; the Action runs its pinned release. After committing the workflow, verify the scan job and its report artifact in Actions.
Findings and thresholds #
The Action defaults to fail: HIGH and CRITICAL findings fail the job. Set fail-on: review to include MEDIUM findings. For an advisory workflow, run the CLI without --fail-on; none is not a supported Action threshold. Input and coverage errors remain nonzero.
For an existing backlog, create and review a baseline, then supply it through the Action's baseline input. CI reads the baseline rather than refreshing it.
Code scanning #
Code Scanning requires an eligible repository with the feature enabled. The workflow separates a read-only scan and artifact job from an upload job with security-events: write. Uploads are skipped for fork and Dependabot pull requests; their scans and artifact preservation still run.
Verify the upload job and the repository's Code Scanning results separately. A report artifact alone does not confirm ingestion. To generate SARIF locally:
lintlang scan AGENTS.md --format sarif --fail-on fail > lintlang.sarif
Keep report destinations separate from scanned inputs. The full released guide covers path detection, upload eligibility, errors, and removal.