jdx/hk v1.40.0

v1.40.0: pklr backend, required env fields, and five new builtins

on GitHub

This release introduces an experimental pure-Rust Pkl evaluator (pklr) as an opt-in backend, adds a required field for steps that need specific environment variables, and expands the builtins library with five new linter/scanner configurations. It also fixes an important staging bug where hk fix could inadvertently stage pre-existing untracked files.

Highlights

• Experimental pklr backend: Set HK_PKL_BACKEND=pklr to evaluate .pkl config files using a built-in Rust evaluator instead of shelling out to the pkl CLI. This eliminates the pkl binary dependency entirely. Proxy, CA certificate, and HTTP rewrite settings are forwarded automatically. Note: pklr is experimental and may not support every pkl feature yet.
• required field for steps: Steps can now declare environment variables that must be present for the step to run. If any are missing, the step is gracefully skipped with a clear message. This is designed for builtins like addlicense where running without user-provided configuration would produce incorrect results.
• Five new builtins: google_java_format, dclint, gitleaks, betterleaks, and mdschema join the built-in linter registry.
• Staging correctness fix: hk fix no longer stages untracked files that existed before the hook ran -- only files newly created by fixers are staged.

Added

• pklr Pkl backend: A pure-Rust Pkl evaluator is now available as an opt-in alternative to the external pkl CLI. Enable it with HK_PKL_BACKEND=pklr. Supports proxy settings, custom CA certificates via HK_PKL_CA_CERTIFICATES, and HTTP rewrites via HK_PKL_HTTP_REWRITE. (@jdx) #768, #769

  export HK_PKL_BACKEND=pklr
  hk run check  # no pkl CLI needed

• required field on steps: Declare environment variables that must be set for a step to run. If any are missing, the step is skipped with a message like skipped: missing required environment variable(s): LICENSE_FILE. Variables can be satisfied by the process environment, the global env block, or the step's own env block. (@timothysparg) #785

  ["addlicense"] {
      required = List("LICENSE_FILE")
      check = "addlicense --check -f $LICENSE_FILE {{files}}"
      fix = "addlicense -f $LICENSE_FILE {{files}}"
  }

  To see skip messages for missing required env vars, add "missing-required-env" to display_skip_reasons.

• google_java_format builtin: Format Java files using google-java-format. Matches **/*.java. (@timothysparg) #777

• dclint builtin: Lint and fix Docker Compose files using dclint. Auto-detected via compose.yml, docker-compose.yml, and variants. (@timothysparg) #779

• gitleaks builtin: Scan for secrets in Git repositories using gitleaks. Auto-detected via .gitleaks.toml. (@hituzi-no-sippo) #749

• betterleaks builtin: Scan for secrets using betterleaks. Auto-detected via .gitleaks.toml or .betterleaks.toml. (@hituzi-no-sippo) #750

• mdschema builtin: Validate Markdown documents against schemas using mdschema. Auto-detected via .mdschema.yml. (@hituzi-no-sippo) #748

Changed

• exclude defaults to List(): The exclude field on steps now defaults to an empty list instead of null. This means you no longer need the null-coalescing operator when extending exclusions in Pkl configs. (@timothysparg) #781

  // Before (required null check)
  exclude = (Builtins.actionlint.exclude ?? List()) + List("**/ignored-dir/**")
  
  // After (just concatenate)
  exclude = Builtins.actionlint.exclude + List("**/ignored-dir/**")

Fixed

• Pre-existing untracked files no longer staged by hk fix: When using the default stage=<JOB_FILES> behavior, untracked files that existed before the hook started are no longer added to the git index. Only files newly created by fixers during the run are staged. Explicit stage globs still opt into staging all matching untracked files. (@jdx) #788

• Pkl package URIs use correct versioned format: Documentation and error messages now use the correct versioned Pkl package URI format (/releases/download/vX.Y.Z/hk@X.Y.Z) instead of invalid /latest/ paths. Error messages also now dynamically reflect the running hk version. (@jdx) #770

New Contributors

• @timothysparg made their first contribution in #777

Full Changelog: v1.39.0...v1.40.0