ironlint-config

# Authoring ironlint checks An ironlint policy lives in `.ironlint.yml` at the project root. A **check** is a file scope plus a shell command (or sequence of steps): ```yaml checks: no-debug: files: "**/*.ts" # glob, or a list of globs run: "! grep -n 'DEBUG'" # proposed content arrives on stdin; nonzero = block ``` - `files` — the glob(s) the check watches. A bare pattern with no `/` (e.g. `*.py`) also matches at any depth. - `run` — a shell command handed to `sh -c`. **Any nonzero exit (1–125) blocks the edit**; exit 0 passes. `126`/`127`/timeout are treated as a broken check, not a block. - `steps` — alternative to `run`: a sequence of `{name?, run}` steps, all fed the same stdin. The first nonzero step blocks. - `on` — lifecycle events: `[write]` (default) fires per file on every agent write; `[pre-commit]` fires once over the selected matching file set (see ABI below). Use `on: [write, pre-commit]` to fire at both. - `name` — optional human-readable label. Parsed and reserved, but **not yet surfaced** in block messages or `ironlint explain` — it's a no-op today. (A `steps` entry's `name`, by contrast, *is* reported as the block's `step` field.) ## ABI — what every check receives - `$IRONLINT_FILE` — absolute path of the single file under check (set for `write`; not set for `pre-commit`). - `$IRONLINT_FILES` — newline-joined list of all selected files (single entry for `write`; the matching file set for `pre-commit`). - `$IRONLINT_ROOT` — project ...