// the find
cloudflare/pint
Prometheus rule linter/validator
pint is a Prometheus/Thanos rule linter from Cloudflare that checks alerting and recording rules for syntax errors, PromQL anti-patterns (missing rate(), unbound selectors, impossible conditions), and rule-set hygiene (duplicates, dependencies, naming). It's aimed at teams running Prometheus at scale who want rule changes linted in CI before they hit production, not just a local syntax checker.
The CI integration is a real differentiator, not an afterthought: it posts inline PR comments on GitHub, GitLab, Bitbucket and TeamCity, diffs against the base branch, and only flags lines actually changed. Several checks go beyond static analysis by querying a live Prometheus/Thanos instance to catch rules that reference series that don't exist or that would be prohibitively expensive to evaluate. The test suite is unusually thorough for a linter - 270+ CLI integration tests covering edge cases like symlinked rule files, multi-doc YAML, YAML anchors/merge keys, and line-shifting in diffs, which suggests the diff/CI logic has actually been hardened against real-world messes rather than just the happy path.
Config is HCL while everything else in the Prometheus ecosystem (rules, scrape configs, Alertmanager) is YAML, so adopting pint means learning a second config syntax just for this tool. The checks that hit a live Prometheus server tie your lint step to the availability and auth of that server - a flaky or slow Prometheus turns 'pint lint' into a source of CI flakiness rather than a pure static check. The README itself is nearly content-free (it's just pointers to GitHub Pages docs), so there's no quick-start example in the repo you'd actually read before cloning - you have to leave the repo to understand what a basic config looks like. With dozens of independent checks each living in its own doc page, getting a mental model of 'what pint actually enforces by default' takes more digging than it should.