feat: add standalone Checkstyle linting

.github/renovate-tracked-deps.json

@@ -16,6 +16,10 @@
       "packageName": "biomejs/biome",
       "datasource": "github-tags"
     },
+    "checkstyle": {
+      "packageName": "checkstyle/checkstyle",
+      "datasource": "github-releases"
+    },
     "editorconfig-checker": {
       "packageName": "editorconfig-checker/editorconfig-checker",
       "datasource": "github-releases"
@@ -109,6 +113,7 @@
         "aqua:jonwiggins/xmloxide",
         "aqua:owenlamont/ryl",
         "biome",
+        "checkstyle",
         "dotnet",
         "editorconfig-checker",
         "go",

.github/renovate.json5

@@ -67,6 +67,7 @@
         "aqua:jonwiggins/xmloxide",
         "aqua:owenlamont/ryl",
         "biome",
+        "checkstyle",
         "editorconfig-checker",
         "golangci-lint",
         "google-java-format",

.github/workflows/lint.yml

@@ -25,8 +25,8 @@ jobs:
       - name: Setup mise
         uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1
         with:
-          version: v2026.7.12
-          sha256: dad54e0b843908324282b8673f9c0ebc3a4da0c49ad2da309a49bfbc918ba180
+          version: v2026.7.14
+          sha256: fc96308f4fa085d7359892ac6351ededb35ecfabf1ddc34f5757bc755a2af8a6
 
       # mise may activate an existing Rust toolchain without adding missing components.
       - name: Install Rust lint components

.github/workflows/mise-registry.yml

@@ -23,8 +23,8 @@ jobs:
       - name: Setup mise
         uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1
         with:
-          version: v2026.7.12
-          sha256: dad54e0b843908324282b8673f9c0ebc3a4da0c49ad2da309a49bfbc918ba180
+          version: v2026.7.14
+          sha256: fc96308f4fa085d7359892ac6351ededb35ecfabf1ddc34f5757bc755a2af8a6
           cache_key: "{{default}}-{{env.MISE_ENABLE_TOOLS}}"
       - name: Restore Rust cache
         uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1

.github/workflows/release-plz.yml

@@ -29,8 +29,8 @@ jobs:
       - name: Setup mise
         uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea  # v4.2.1
         with:
-          version: v2026.7.12
-          sha256: dad54e0b843908324282b8673f9c0ebc3a4da0c49ad2da309a49bfbc918ba180
+          version: v2026.7.14
+          sha256: fc96308f4fa085d7359892ac6351ededb35ecfabf1ddc34f5757bc755a2af8a6
           cache_key: "{{default}}-{{env.MISE_ENABLE_TOOLS}}"
       - name: Create release metadata
         env:
@@ -62,8 +62,8 @@ jobs:
       - name: Setup mise
         uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea  # v4.2.1
         with:
-          version: v2026.7.12
-          sha256: dad54e0b843908324282b8673f9c0ebc3a4da0c49ad2da309a49bfbc918ba180
+          version: v2026.7.14
+          sha256: fc96308f4fa085d7359892ac6351ededb35ecfabf1ddc34f5757bc755a2af8a6
           cache_key: "{{default}}-{{env.MISE_ENABLE_TOOLS}}"
       - name: Update release PR
         env:

.github/workflows/release.yml

@@ -30,35 +30,35 @@ jobs:
         include:
           - target: x86_64-unknown-linux-gnu
             runner: ubuntu-24.04
-            mise_version: v2026.7.12
-            mise_sha256: dad54e0b843908324282b8673f9c0ebc3a4da0c49ad2da309a49bfbc918ba180
+            mise_version: v2026.7.14
+            mise_sha256: fc96308f4fa085d7359892ac6351ededb35ecfabf1ddc34f5757bc755a2af8a6
           - target: x86_64-unknown-linux-musl
             runner: ubuntu-24.04
             build-tool: cross
-            mise_version: v2026.7.12
-            mise_sha256: dad54e0b843908324282b8673f9c0ebc3a4da0c49ad2da309a49bfbc918ba180
+            mise_version: v2026.7.14
+            mise_sha256: fc96308f4fa085d7359892ac6351ededb35ecfabf1ddc34f5757bc755a2af8a6
           - target: aarch64-unknown-linux-gnu
             runner: ubuntu-24.04
             build-tool: cross
-            mise_version: v2026.7.12
-            mise_sha256: dad54e0b843908324282b8673f9c0ebc3a4da0c49ad2da309a49bfbc918ba180
+            mise_version: v2026.7.14
+            mise_sha256: fc96308f4fa085d7359892ac6351ededb35ecfabf1ddc34f5757bc755a2af8a6
           - target: aarch64-unknown-linux-musl
             runner: ubuntu-24.04
             build-tool: cross
-            mise_version: v2026.7.12
-            mise_sha256: dad54e0b843908324282b8673f9c0ebc3a4da0c49ad2da309a49bfbc918ba180
+            mise_version: v2026.7.14
+            mise_sha256: fc96308f4fa085d7359892ac6351ededb35ecfabf1ddc34f5757bc755a2af8a6
           - target: x86_64-apple-darwin
             runner: macos-15-intel
-            mise_version: v2026.7.12
-            mise_sha256: bbe1d2378dd42ff562b4fe688bf235e64c326117428f02c6a634dead29bd0945
+            mise_version: v2026.7.14
+            mise_sha256: 3a3cf40fd034f83bd5cdffd4d673d40b04a79d06affbd30e5fcc4f00ae0ac460
           - target: aarch64-apple-darwin
             runner: macos-latest
-            mise_version: v2026.7.12
-            mise_sha256: 4268f41491bcb89e750951041d415a847495639a00e894075c62057633d06982
+            mise_version: v2026.7.14
+            mise_sha256: 082262daa1cd73e22f71272c574afda560c4fcf39852bc18884eae9e13cd5f2c
           - target: x86_64-pc-windows-msvc
             runner: windows-latest
-            mise_version: v2026.7.12
-            mise_sha256: 50781ee1c71d3b19de5299fd6dba917489cd24127da2aa69ec03cc18074284a7
+            mise_version: v2026.7.14
+            mise_sha256: acf83125cf0166701ffa661be72cbb26a852d31b22d2acc399a974f1d3812862
 
     steps:
       - name: Checkout code

.github/workflows/test.yml

@@ -17,18 +17,18 @@ jobs:
       matrix:
         include:
           - os: ubuntu-24.04
-            mise_version: v2026.7.12
-            mise_sha256: dad54e0b843908324282b8673f9c0ebc3a4da0c49ad2da309a49bfbc918ba180
+            mise_version: v2026.7.14
+            mise_sha256: fc96308f4fa085d7359892ac6351ededb35ecfabf1ddc34f5757bc755a2af8a6
             aube_node_linker: isolated
             aube_package_import_method: auto
           - os: macos-15
-            mise_version: v2026.7.12
-            mise_sha256: 4268f41491bcb89e750951041d415a847495639a00e894075c62057633d06982
+            mise_version: v2026.7.14
+            mise_sha256: 082262daa1cd73e22f71272c574afda560c4fcf39852bc18884eae9e13cd5f2c
             aube_node_linker: isolated
             aube_package_import_method: auto
           - os: windows-2025
-            mise_version: v2026.7.12
-            mise_sha256: 50781ee1c71d3b19de5299fd6dba917489cd24127da2aa69ec03cc18074284a7
+            mise_version: v2026.7.14
+            mise_sha256: acf83125cf0166701ffa661be72cbb26a852d31b22d2acc399a974f1d3812862
             # Use a physical npm tree so mise-action can cache it reliably.
             aube_node_linker: hoisted
             aube_package_import_method: copy

README.md

@@ -150,7 +150,7 @@ For Flint contributor workflow and local testing tips, see
 | ----------------------- | ------------------------------------------------ | ---------------------------------------------------------- |
 | C#                      | —                                                | [`dotnet-format`](docs/linters/dotnet-format.md)           |
 | Go                      | [`golangci-lint`](docs/linters/golangci-lint.md) | [`gofmt`](docs/linters/gofmt.md)                           |
-| Java                    | —                                                | [`google-java-format`](docs/linters/google-java-format.md) |
+| Java                    | [`checkstyle`](docs/linters/checkstyle.md)       | [`google-java-format`](docs/linters/google-java-format.md) |
 | JavaScript / TypeScript | [`biome`](docs/linters/biome.md)                 | [`biome-format`](docs/linters/biome-format.md)             |
 | Kotlin                  | [`ktlint`](docs/linters/ktlint.md)               | [`ktlint`](docs/linters/ktlint.md)                         |
 | Python                  | [`ruff`](docs/linters/ruff.md)                   | [`ruff-format`](docs/linters/ruff-format.md)               |

default.json

@@ -31,6 +31,7 @@
         "aqua:jonwiggins/xmloxide",
         "aqua:owenlamont/ryl",
         "biome",
+        "checkstyle",
         "editorconfig-checker",
         "golangci-lint",
         "google-java-format",

docs/linters.md

@@ -14,7 +14,7 @@ page with its behavior, configuration, and examples.
 | ----------------------- | ------------------------------------------- | ----------------------------------------------------- |
 | C#                      | —                                           | [`dotnet-format`](linters/dotnet-format.md)           |
 | Go                      | [`golangci-lint`](linters/golangci-lint.md) | [`gofmt`](linters/gofmt.md)                           |
-| Java                    | —                                           | [`google-java-format`](linters/google-java-format.md) |
+| Java                    | [`checkstyle`](linters/checkstyle.md)       | [`google-java-format`](linters/google-java-format.md) |
 | JavaScript / TypeScript | [`biome`](linters/biome.md)                 | [`biome-format`](linters/biome-format.md)             |
 | Kotlin                  | [`ktlint`](linters/ktlint.md)               | [`ktlint`](linters/ktlint.md)                         |
 | Python                  | [`ruff`](linters/ruff.md)                   | [`ruff-format`](linters/ruff-format.md)               |

docs/linters/checkstyle.md

@@ -0,0 +1,28 @@
+# `checkstyle`
+
+<!-- linter-metadata-start -->
+<!-- Generated. Run `mise run generate` to regenerate. -->
+
+|          |                                                        |
+| -------- | ------------------------------------------------------ |
+| Project  | [checkstyle](https://github.com/checkstyle/checkstyle) |
+| Fix      | no                                                     |
+| Binary   | `checkstyle`                                           |
+| Scope    | [files](../linters.md#scope-files)                     |
+| Patterns | `*.java`                                               |
+| Config   | [`checkstyle.xml`](https://checkstyle.org/config.html) |
+
+<!-- linter-metadata-end -->
+
+`checkstyle` checks Java source against a repository-owned coding standard. It
+is report-only; use a formatter such as
+[`google-java-format`](google-java-format.md) for safe formatting fixes.
+
+Flint runs the standalone Checkstyle CLI against selected Java files. A Java
+runtime must be available on `PATH` because Checkstyle is distributed as a JAR.
+Flint resolves that JAR from the direct `checkstyle` entry in `mise.toml` and
+invokes it with `java -jar` on every platform.
+
+The repository must provide `checkstyle.xml` at its root. A root-level
+`checkstyle-suppressions.xml` is also supported through Checkstyle's standard
+property default. Flint does not infer Maven or Gradle source roots.

mise.toml

@@ -13,6 +13,7 @@ actionlint = "1.7.12"
 "aqua:jonwiggins/xmloxide" = "0.4.4"
 "aqua:owenlamont/ryl" = "0.21.0"
 biome = "2.5.5"
+checkstyle = "13.8.0"
 editorconfig-checker = "3.8.0"
 golangci-lint = "2.12.2"
 google-java-format = "1.35.0"

src/init/scaffold.rs

@@ -55,8 +55,8 @@ jobs:
       - name: Setup mise
         uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1
         with:
-          version: v2026.7.12
-          sha256: dad54e0b843908324282b8673f9c0ebc3a4da0c49ad2da309a49bfbc918ba180
+          version: v2026.7.14
+          sha256: fc96308f4fa085d7359892ac6351ededb35ecfabf1ddc34f5757bc755a2af8a6
 {rust_steps}
       - name: Lint
         env:

src/linters/mod.rs

@@ -21,13 +21,13 @@ pub use crate::registry::LinterOutput;
 /// - PE binary without extension → execute directly by full path
 /// - Everything else → route through `cmd.exe /C` to handle `.cmd` shims
 ///
-/// Self-executing JARs (e.g. ktlint) cannot run via cmd.exe at all.
-/// When `windows_java_jar` is true the binary is resolved to its full path
-/// and invoked as `java -jar <path>`.
-pub fn spawn_command(argv: &[String], windows_java_jar: bool) -> tokio::process::Command {
+/// Self-executing JARs (e.g. ktlint and Checkstyle) need to be invoked through
+/// the JVM. When `java_jar` is true the resolved tool path is invoked as
+/// `java -jar <path>` on every platform.
+pub fn spawn_command(argv: &[String], java_jar: bool) -> tokio::process::Command {
     #[cfg(windows)]
     {
-        if windows_java_jar {
+        if java_jar {
             if let Some(path) = find_file_in_path(&argv[0]) {
                 let mut cmd = tokio::process::Command::new("java");
                 cmd.arg("-jar").arg(path).args(&argv[1..]);
@@ -44,7 +44,12 @@ pub fn spawn_command(argv: &[String], windows_java_jar: bool) -> tokio::process:
     }
     #[cfg(not(windows))]
     {
-        let _ = windows_java_jar;
+        if java_jar {
+            let jar = find_file_in_path(&argv[0]).unwrap_or_else(|| argv[0].clone().into());
+            let mut cmd = tokio::process::Command::new("java");
+            cmd.arg("-jar").arg(jar).args(&argv[1..]);
+            return cmd;
+        }
         let mut cmd = tokio::process::Command::new(&argv[0]);
         cmd.args(&argv[1..]);
         cmd
@@ -79,7 +84,7 @@ fn find_pe_binary(binary: &str) -> Option<std::path::PathBuf> {
 
 /// On Windows, return the full path of `binary` from PATH without inspecting
 /// its contents. Used for self-executing JARs where the caller already knows
-/// the invocation style (i.e. `windows_java_jar` is set in the registry).
+/// the invocation style (i.e. `java_jar` is set in the registry).
 #[cfg(windows)]
 fn find_file_in_path(binary: &str) -> Option<std::path::PathBuf> {
     let path_var = std::env::var("PATH").ok()?;
@@ -88,3 +93,12 @@ fn find_file_in_path(binary: &str) -> Option<std::path::PathBuf> {
         candidate.is_file().then_some(candidate)
     })
 }
+
+#[cfg(not(windows))]
+fn find_file_in_path(binary: &str) -> Option<std::path::PathBuf> {
+    let path_var = std::env::var("PATH").ok()?;
+    std::env::split_paths(&path_var).find_map(|dir| {
+        let candidate = dir.join(binary);
+        candidate.is_file().then_some(candidate)
+    })
+}