LintPal demo

This repository demonstrates LintPal on a small Go HTTP service. The default branch is a passing baseline. The canonical pull request intentionally introduces authorization and input-validation violations so LintPal can publish inline findings and a deterministic gate result.

export DEMO_API_KEY='local-demo-key'
go run ./cmd/server

Create an order:

curl -i http://localhost:8080/orders \
  -H 'Authorization: Bearer local-demo-key' \
  -H 'Content-Type: application/json' \
  --data '{"customer":"Ada","item":"keyboard","quantity":2}'

The committed .lintpal/rules/ files come from the versioned LintPal rule catalog:

lintpal rule import github:diffpal/lintpal-rules//general@v1.1.0
lintpal rule import github:diffpal/lintpal-rules//go@v1.1.0
lintpal rule validate

The catalog's 0.90 authorization and input-validation thresholds are calibrated against the live Jev demo case. Production repositories should choose thresholds for their own gate policy.

1. Open Settings → Secrets and variables → Actions.
2. Add a repository secret named TYPESAFE_API_KEY containing the TypeSafe/Jev provider key.
3. Re-run the LintPal workflow on the canonical pull request.

The workflow uses GitHub's generated GITHUB_TOKEN only to publish the check result and inline comments. Provider credentials are environment variables, never Action inputs. A job-level same-repository guard prevents fork pull requests from reaching TYPESAFE_API_KEY.

LintPal classifies changed lines against fixed rules through Jev. It does not generate a narrative code review. The summary is deterministic: No blocking findings, 1 blocking finding, or N blocking findings.

• LintPal CLI
• Reusable GitHub Action
• Versioned rule catalog

MIT licensed. See LICENSE.