
Security News
Deno 2.6 + Socket: Supply Chain Defense In Your CLI
Deno 2.6 introduces deno audit with a new --socket flag that plugs directly into Socket to bring supply chain security checks into the Deno CLI.
github.com/aspect-build/rules_lint
Advanced tools
This ruleset integrates linting and formatting as first-class concepts under Bazel.
Features:
bazel query output.
Instead, users simply lint their existing *_library targets.sh_library targets for your shell scripts, for example.Watch Alex's talk at BazelCon 2024:
New tools are being added frequently, so check this page again!
Linters which are not language-specific:
| Language | Formatter | Linter(s) |
|---|---|---|
| C / C++ | clang-format | clang-tidy |
| Cuda | clang-format | |
| CSS, Less, Sass | Prettier | Stylelint |
| Go | gofmt or gofumpt | |
| Gherkin | prettier-plugin-gherkin | |
| GraphQL | Prettier | |
| HCL (Hashicorp Config) | terraform fmt | |
| HTML | Prettier | |
| JSON | Prettier | |
| Java | google-java-format | pmd , Checkstyle, Spotbugs |
| JavaScript | Prettier | ESLint |
| HTML templates | djlint | |
| Jsonnet | jsonnetfmt | |
| Kotlin | ktfmt | ktlint |
| Markdown | Prettier | Vale |
| Protocol Buffer | buf | buf lint |
| Python | ruff | flake8, pylint, ruff |
| Ruby | RuboCop | |
| Rust | rustfmt | |
| SQL | prettier-plugin-sql | |
| Scala | scalafmt | |
| Shell | shfmt | shellcheck |
| Starlark | Buildifier | |
| Swift | SwiftFormat (1) | |
| TOML | taplo | |
| TSX | Prettier | ESLint |
| TypeScript | Prettier | ESLint |
| YAML | yamlfmt | yamllint |
| XML | prettier/plugin-xml |
To add a tool, please follow the steps in lint/README.md or format/README.md and then send us a PR. Thanks!!
Follow instructions from the release you wish to use: https://github.com/aspect-build/rules_lint/releases
Formatting and Linting are inherently different, which leads to differences in how they are used in rules_lint. It is best concieved as two rulesets in one.
| Formatter | Linter |
|---|---|
| Only one per language, since they could conflict with each other. | Many per language is fine; results compose. |
| Invariant: program's behavior is never changed. | Suggested fixes may change behavior. |
| Developer has no choices. Always blindly accept result. | Fix may be manual, or select from multiple auto-fixes. |
| Changes must be applied. | Violations can be suppressed. |
| Operates on a single file at a time. | Can require the dependency graph. |
| Can always format just changed files / regions | New violations might be introduced in unchanged files. |
| Fast enough to put in a pre-commit workflow. | Some are slow. |
To format files, run the target you create when you install rules_lint.
We recommend using a Git pre-commit hook to format changed files, and Aspect Workflows to provide the check on CI.
See Formatting for more ways to use the formatter.
Also see API Documentation
Demo:
To lint code, we recommend using the Aspect CLI to get the missing lint command, and Aspect Workflows to provide first-class support for "linters as code reviewers".
For example, running bazel lint //src:all prints lint warnings to the terminal for all targets in the //src package.
Suggested fixes from the linter tools are presented interactively.
See Linting for more ways to use the linter.
Also see API Documentation
Demo:
The linters only visit files that are part of the Bazel dependency graph (listed as srcs to some library target).
The formatter honors the .gitignore and .gitattributes files.
Otherwise use the affordance provided by the tool, for example .prettierignore for files to be ignored by Prettier.
Sometimes engineers want to ignore a file with a certain extension because the content isn't actually valid syntax for the corresponding language.
For example, you might write a template for YAML and name it my-template.yaml even though it needs to have some interpolated values inserted before it's syntactically valid.
We recommend instead fixing the file extension. In this example, my.yaml.tmpl or my-template.yaml_ might be better.
We believe that existing editor plugins should just work as-is. They may download or bundle their own copy of the tools, which can lead to some version skew in lint/format rules.
For formatting, we believe it's a waste of time to configure these in the editor, because developers should just rely on formatting happening when they commit and not care what the code looks like before that point. But we're not trying to stop anyone, either!
You could probably configure the editor to always run the same Bazel command, any time a file is changed. Instructions to do this are out-of-scope for this repo, particularly since they have to be formulated and updated for so many editors.
This ruleset collects limited usage data via tools_telemetry, which is reported to Aspect Build Inc and governed by our privacy policy.
FAQs
Unknown package
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Deno 2.6 introduces deno audit with a new --socket flag that plugs directly into Socket to bring supply chain security checks into the Deno CLI.

Security News
New DoS and source code exposure bugs in React Server Components and Next.js: what’s affected and how to update safely.

Security News
Socket CEO Feross Aboukhadijeh joins Software Engineering Daily to discuss modern software supply chain attacks and rising AI-driven security risks.