Problem

flint v2 currently scopes normal PR runs to changed files, but it does not reliably establish a full baseline when lint coverage changes. If a repo adds a new linter, or changes a linter config, the affected linter must run against all matching files once. Otherwise pre-existing violations remain hidden until an unrelated PR later touches one of those files.

This surfaced during rollout when grafana/docker-otel-lgtm had an unrelated PR trip ShellCheck on an existing source ./logging.sh pattern. A full v2-style ShellCheck run on main would also have failed, but changed-file mode did not establish that baseline during migration.

There is also a ShellCheck parity bug: v2 used shellcheck {FILE}. For scripts in subdirectories that source sibling files, ShellCheck needs -x -P SCRIPTDIR so source ./file.sh resolves relative to the script directory.

Expected behavior

In changed-file mode:

• normal PRs should keep running only affected files
• newly active linters should run all matching files once to establish a baseline
• changed per-linter config files should run all matching files for that linter
• changed flint.toml should run all matching files for checks configured through flint.toml
• ShellCheck should follow sourced files relative to the script directory

Local fix in progress

A local patch currently does the following:

• routes newly active linters to an all-files file list
• routes changed per-linter config files to all-files for that linter
• routes changed flint.toml to all-files for special flint-configured checks
• changes ShellCheck to shellcheck -x -P SCRIPTDIR {FILE}
• adds regression fixtures for new-linter baseline, config-change baseline, and ShellCheck sourced sibling files

Local verification:

• cargo test
• mise run lint:fix

Consumer audit snapshot