feat: add flint v2 Rust binary

.editorconfig

@@ -10,5 +10,9 @@ max_line_length = 120
 [*.py]
 indent_size = 4
 
+[*.rs]
+indent_size = 4
+max_line_length = off
+
 [{CLAUDE.md,.editorconfig,super-linter.env,lychee.toml,renovate.json5,default.json,mise.toml}]
 max_line_length = 300

.gitattributes

@@ -0,0 +1 @@
+* text=auto eol=lf

.github/agents/knowledge/README.md

@@ -0,0 +1,14 @@
+# Knowledge Index
+
+Reusable repository guidance for agents working on flint v2.
+
+Load only files relevant to the current scope.
+
+## Topics
+
+| File              | Load when                                                                         |
+| ----------------- | --------------------------------------------------------------------------------- |
+| `architecture.md` | Navigating the codebase; understanding module roles or check kinds                |
+| `linters.md`      | Adding, modifying, or debugging a linter; `registry.rs` changes; config injection |
+| `design.md`       | Questioning why something works the way it does; avoiding known pitfalls          |
+| `testing.md`      | Writing or updating tests; adding fixture cases; regenerating snapshots           |

.github/agents/knowledge/architecture.md

@@ -0,0 +1,38 @@
+# Architecture
+
+## Module Map
+
+- **`src/registry.rs`**: Static linter registry. Defines
+  `Check` (builder pattern) and `builtin()` which returns
+  the full list of built-in checks. This is where new
+  linters are added.
+- **`src/runner.rs`**: Executes checks against a file list.
+  Handles parallel execution (check mode) and serial
+  execution (fix mode, to avoid concurrent writes).
+- **`src/config.rs`**: Loads `flint.toml` from the project
+  root. All fields have defaults — the file is optional.
+- **`src/files.rs`**: Git-aware file discovery. Returns
+  changed files relative to the merge base, or all files
+  with `--full`.
+- **`src/linters/`**: Custom logic for special checks that
+  can't be expressed as a simple command template:
+  - `lychee.rs`: Link checking orchestration
+  - `renovate_deps.rs`: Renovate snapshot verification
+- **`src/main.rs`**: CLI parsing (clap), orchestration,
+  output formatting.
+- **`tests/e2e.rs`**: End-to-end tests. Spin up a temp git
+  repo, write files, run the flint binary, assert on
+  stdout/stderr and exit code.
+
+## Check Kinds
+
+A `Check` is either a `Template` (a command string with
+`{FILE}`, `{FILES}`, or `{MERGE_BASE}` placeholders) or a
+`Special` (custom Rust logic in `src/linters/`).
+
+Template scopes:
+
+- `File` — invoked once per matched file (`{FILE}`)
+- `Files` — invoked once with all matched files (`{FILES}`)
+- `Project` — invoked once with no file args; skipped
+  entirely if no matching files changed

.github/agents/knowledge/design.md

@@ -0,0 +1,48 @@
+# Key Design Decisions
+
+1. **Activation via `mise.toml`**: A check is active when
+   its tool (or `mise_tool_name` override) is declared in
+   the consuming repo's `mise.toml`. No PATH probing —
+   mise guarantees declared tools are on PATH.
+
+2. **`editorconfig-checker` deference**: `editorconfig-checker`
+   (binary: `ec`) runs on all files but skips file types owned
+   by active line-length-enforcing formatters (`cargo-fmt`,
+   `ruff-format`, `biome-format`, `prettier`). Implemented
+   via `.defer_to_formatters()` on the `editorconfig-checker`
+   entry. This avoids its `max_line_length` check conflicting
+   with formatter output.
+
+3. **markdownlint + prettier on `*.md`**: Both checkers are
+   active when their tools are installed. They cover
+   different concerns (markdownlint: structural rules;
+   prettier: formatting). To avoid MD013 (line length)
+   conflicting with prettier's line wrapping, consuming
+   repos must disable MD013 in `.markdownlint.json`:
+
+   ```json
+   { "MD013": false }
+   ```
+
+4. **Fix mode runs serially**: `runner.rs` runs checks in
+   parallel in check mode, but serially in fix mode to
+   avoid concurrent writes to the same file.
+
+5. **Version ranges**: When a `bin_name` has any
+   `version_range` entries, every entry for that binary
+   must have one (enforced by a registry unit test). This
+   prevents ambiguous activation when ranges don't cover
+   all versions.
+
+6. **Special checks**: `links` and `renovate-deps` have
+   custom orchestration logic that doesn't fit the command
+   template model. Their implementations live in
+   `src/linters/`.
+
+7. **Built-in file exclusions**: `src/files.rs` has a
+   `BUILTIN_EXCLUDES` slice of paths that are always removed
+   from the file list before any linter sees it. Currently
+   contains `.github/renovate-tracked-deps.json` (a
+   generated file that should never be linted by prettier,
+   ec, etc.). Add entries here — not in user-facing `exclude`
+   docs — when a file is managed by flint itself.

.github/agents/knowledge/linters.md

@@ -0,0 +1,80 @@
+# Adding a New Linter
+
+Add an entry to `builtin()` in `src/registry.rs` using the
+builder pattern:
+
+```rust
+// File scope — invoked per file
+Check::file("mytool", "mytool --check {FILE}", &["*.ext"])
+    .fix("mytool --fix {FILE}"),
+
+// Files scope — invoked once with all matched files (absolute paths)
+Check::files("mytool", "mytool {FILES}", &["*.ext"])
+    .fix("mytool --fix {FILES}"),
+
+// Files scope — invoked once with all matched files (relative to project root)
+// Use {RELFILES} when the tool requires paths relative to the project root
+// (e.g. dotnet format --include).
+Check::files("mytool", "mytool --include {RELFILES}", &["*.ext"])
+    .fix("mytool --fix --include {RELFILES}"),
+
+// Project scope — invoked once, skipped if no *.ext changed
+Check::project("mytool", "mytool run", &["*.ext"]),
+```
+
+Available builder modifiers:
+
+| Method                       | Purpose                                                                       |
+| ---------------------------- | ----------------------------------------------------------------------------- |
+| `.fix(cmd)`                  | Enable `--fix` mode with this command                                         |
+| `.bin(name)`                 | Override binary name (when check name ≠ binary)                               |
+| `.mise_tool(name)`           | Look up availability under a different mise key (e.g. `rust` for `cargo-fmt`) |
+| `.version_req(range)`        | Restrict to a semver range (e.g. `">=1.0.0"`)                                 |
+| `.excludes(names)`           | Skip files already owned by these active checks                               |
+| `.slow()`                    | Mark as slow — skipped by `--fast-only`                                       |
+| `.linter_config(file, flag)` | Inject a config flag when `FLINT_CONFIG_DIR/<file>` exists (see below)        |
+
+## Config File Injection (`.linter_config`)
+
+Use `.linter_config(filename, flag)` when the tool supports an explicit config
+file path via a CLI flag. At runtime, if `FLINT_CONFIG_DIR/<filename>` exists,
+flint injects `flag <abs-path>` right after the binary name in the command.
+If the file is absent the flag is silently omitted — native config discovery
+remains in effect.
+
+```rust
+// Example: markdownlint accepts --config <path>
+Check::file("markdownlint", "markdownlint {FILE}", &["*.md"])
+    .fix("markdownlint --fix {FILE}")
+    .linter_config(".markdownlint.json", "--config"),
+// → markdownlint --config /repo/.github/config/.markdownlint.json <file>
+```
+
+**When NOT to use it:**
+
+- The tool has no explicit `--config`/`--rcfile`/equivalent flag (e.g. `shfmt`)
+- The flag accepts a **directory** rather than a file (e.g. biome's
+  `--config-path <dir>`) — a different injection shape is needed. For biome,
+  check for `biome.json` existence but pass `config_dir` itself as the arg:
+  `biome --config-path <config_dir> check <file>`. This requires a variant of
+  `.linter_config` that injects the directory rather than the full file path
+  (not yet implemented)
+- The tool is project-scoped and its config must live at the project root to
+  function (no explicit `--config` flag exists)
+
+Look up the tool's `--help` or man page for the config flag name and expected
+argument type before adding `.linter_config`.
+
+For checks that need custom logic (not a simple command template), add a module
+under `src/linters/` and use `CheckKind::Special`.
+
+## Changed-files scoping
+
+Most linters use `file` or `files` scope, so they naturally receive only changed
+files as arguments. `golangci-lint` uses `project` scope but scopes internally via
+`--new-from-rev={MERGE_BASE}`.
+
+**`cargo-clippy` cannot scope to changed files.** Cargo has no git-aware flag
+equivalent to `--new-from-rev`. It still skips entirely when no `*.rs` files
+changed, but when it does run it checks the whole project. Workspace support
+(`-p <pkg> --no-deps` per changed package) would be a future improvement.

.github/agents/knowledge/testing.md

@@ -0,0 +1,60 @@
+# Testing
+
+Run all tests with:
+
+```bash
+cargo test
+```
+
+## Unit Tests
+
+In-module `#[cfg(test)]` blocks in `src/`. Notable:
+
+- `src/registry.rs`: enforces version-range consistency
+- `src/runner.rs`: config injection, scope filtering
+- `src/linters/renovate_deps.rs`: log parsing, snapshot
+  read/write, diff output
+
+## Fixture-based E2E Tests
+
+`tests/cases/` holds one directory per scenario. Each
+contains:
+
+- `files/` — files copied verbatim into a temp git repo
+  and staged before the run
+- `test.toml` — test spec:
+
+```toml
+[expected]
+args = "--full shellcheck"
+exit = 1                    # optional, default 0
+stderr = """
+...golden output...
+"""
+
+[expected.files]            # optional: assert files written by --fix
+".github/renovate-tracked-deps.json" = """
+{...}
+"""
+
+[env]                       # optional extra env vars
+FOO = "bar"
+
+[fake_bins]                 # optional fake binaries (Unix only)
+renovate = '''
+#!/bin/sh
+echo '...'
+'''
+```
+
+The `cases` test in `tests/e2e.rs` runs all of them.
+Set `UPDATE_SNAPSHOTS=1` to regenerate `[expected].exit`/
+`stderr`/`stdout` in place. `[expected.files]` and `[fake_bins]`
+are always preserved by the snapshot writer.
+
+Use fixture cases for any check — including ones that require
+fake external binaries (via `[fake_bins]`). The fixture runner
+writes each binary into a tempdir and prepends it to `PATH`.
+
+When adding a new check, cover at least: clean pass, failure
+with correct diff/output, and fix mode if supported.

.github/config/flint.toml

@@ -0,0 +1,5 @@
+[settings]
+exclude = ["CHANGELOG.md", "tests/cases/**"]
+
+[checks.renovate-deps]
+exclude_managers = ["github-actions", "github-runners", "cargo"]

.github/renovate-tracked-deps.json

@@ -4,19 +4,40 @@
       "mise"
     ]
   },
-  "README.md": {
+  ".github/workflows/test.yml": {
     "regex": [
-      "grafana/flint"
+      "mise"
     ]
   },
   "mise.toml": {
     "mise": [
+      "actionlint",
+      "cargo:xmloxide",
+      "dotnet",
+      "editorconfig-checker",
+      "github:google/google-java-format",
+      "github:koalaman/shellcheck",
+      "github:mvdan/sh",
+      "github:pinterest/ktlint",
+      "go",
+      "golangci-lint",
+      "hadolint",
       "lychee",
       "node",
-      "npm:renovate"
-    ],
+      "npm:@biomejs/biome",
+      "npm:markdownlint-cli2",
+      "npm:prettier",
+      "npm:renovate",
+      "pipx:codespell",
+      "pipx:ruff",
+      "rust"
+    ]
+  },
+  "src/init/generation.rs": {
     "regex": [
-      "ghcr.io/super-linter/super-linter"
+      "actions/checkout",
+      "jdx/mise-action",
+      "mise"
     ]
   }
 }

.github/renovate.json5

@@ -5,7 +5,7 @@
   dependencyDashboard: true,
   platformCommit: "enabled",
   automerge: true,
-  ignorePaths: [],
+  ignorePaths: ["tests/"],
   ignorePresets: [":ignoreModulesAndTests"],
   ignoreUnstable: true,
   vulnerabilityAlerts: {
@@ -38,6 +38,33 @@
       depNameTemplate: "mise",
       matchStrings: ["jdx/mise-action.*\\n\\s*with:\\s*\\n\\s*version: [\"']?(?<currentValue>v[.\\d]+)[\"']?\\s*\\n\\s*sha256: [\"']?(?<currentDigest>\\w+)[\"']?"],
     },
+    {
+      customType: "regex",
+      description: "Update GitHub Action SHA pins embedded in the generated workflow template (src/init/generation.rs)",
+      managerFilePatterns: ["/^src/init/generation\\.rs$/"],
+      matchStrings: ["uses: (?<depName>[^@\\\\]+)@(?<currentDigest>[a-f0-9]{40})\\s*#\\s*(?<currentValue>v[^\\s'\"\\\\]+)"],
+      datasourceTemplate: "github-tags",
+    },
+    {
+      customType: "regex",
+      description: "Update mise per-platform sha256 hashes in test.yml matrix",
+      managerFilePatterns: ["/.github/workflows/test.yml/"],
+      datasourceTemplate: "github-release-attachments",
+      packageNameTemplate: "jdx/mise",
+      depNameTemplate: "mise",
+      matchStrings: [
+        "mise_version: [\"']?(?<currentValue>v[.\\d]+)[\"']?\\s*\\n\\s*mise_sha256: [\"']?(?<currentDigest>[a-f0-9]{64})[\"']?",
+      ],
+    },
+    {
+      customType: "regex",
+      description: "Update mise version embedded in the generated workflow template (src/init/generation.rs)",
+      managerFilePatterns: ["/^src/init/generation\\.rs$/"],
+      datasourceTemplate: "github-release-attachments",
+      packageNameTemplate: "jdx/mise",
+      depNameTemplate: "mise",
+      matchStrings: ["jdx/mise-action.*\\n\\s*with:\\s*\\n\\s*version: [\"']?(?<currentValue>v[.\\d]+)[\"']?\\s*\\n\\s*sha256: [\"']?(?<currentDigest>\\w+)[\"']?"],
+    },
   ],
   packageRules: [
     {

.github/workflows/lint.yml

@@ -2,6 +2,8 @@
 name: Lint
 
 on:
+  push:
+    branches: [main] # warms the Rust cache so PR branches get a cache hit
   pull_request:
 
 permissions: {}
@@ -26,6 +28,13 @@ jobs:
           version: v2026.4.1
           sha256: c597fa1e4da76d1ea1967111d150a6a655ca51a72f4cd17fdc584be2b9eaa8bd
 
+      # mise may activate an existing Rust toolchain without adding missing components.
+      - name: Install Rust lint components
+        run: rustup component add clippy rustfmt
+
+      - name: Restore cache
+        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+
       - name: Lint
         env:
           GITHUB_TOKEN: ${{ github.token }}