jdx/hk v2.10.0

v2.10.0: Hook timeouts and six new builtins

on GitHub

hk 2.10.0 adds a hook-level timeout that fails a hook when it runs too long. It also adds six builtins: trufflehog, osv-scanner, pyright, phpstan, protolint and dotenv-linter.

Added

• Hook timeout (#1776, @jdx). Set timeout on a hook to cap how long it can run in total. The limit covers all of the hook's steps, including time spent waiting for the stash lock. When the time runs out, hk stops the running steps the way Ctrl-C does, restores any stashed changes, and fails the hook with pre-commit: timed out after 10s, so the commit or push is blocked.

  hooks {
    ["pre-commit"] {
      fix = true
      timeout = "10s"
      steps = linters
    }
  }

  A value is a number followed by a unit (ms, s, m or h). You can combine units, as in "1m30s". hk rejects a bare number, zero or an unknown unit when it loads the config. If you don't set timeout, a hook runs until its steps finish, as before. The setting applies only to whole hooks: there is no per-step or global timeout. As with other hook-level settings, hk ignores it in subproject configs.

• New builtins (all by @illesnagy1):

  • trufflehog (#1774) scans text files for secrets. It runs offline with --no-verification, so it does not contact providers to check whether a credential it finds is live. Add a trufflehog:ignore comment to suppress a finding.
  • osv_scanner (#1782) checks dependency lockfiles and manifests for known vulnerabilities using the OSV database. It covers files such as Cargo.lock, package-lock.json, pnpm-lock.yaml, uv.lock, go.mod and Gemfile.lock, and it reads osv-scanner.toml for ignores. The scanner queries api.osv.dev, so it needs network access. It only checks and has no fix mode.
  • pyright (#1775) type-checks *.py, *.pyi and *.pyw files.
  • phpstan (#1778) runs static analysis on *.php files.
  • protolint (#1777) lints and fixes *.proto files.
  • dotenv_linter (#1779) lints and fixes .env, .env.* and *.env files. Fixes don't leave .bak files behind.

  hk init detects some of these tools from your project files: osv-scanner.toml; pyrightconfig.json or a [tool.pyright] table in pyproject.toml; phpstan.neon, phpstan.neon.dist, phpstan.dist.neon or a composer.json that mentions phpstan; and .protolint.yaml, .protolint.yml, protolint.yaml or protolint.yml.

Changed

• Pre-push explains the expected stdin format (#1781, @connormharris). Before, a malformed line on pre-push stdin only got a per-line warning. hk now also prints the expected format once: <local ref> <local SHA> <remote ref> <remote SHA>, with full-length SHAs. Valid lines are still processed.

Full Changelog: v2.9.0...v2.10.0

💚 Sponsor hk

hk is built and maintained by @jdx, an open source developer at entire.io, the title sponsor of his open source work.

If hk speeds up your pre-commit loop or makes linting less painful, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep hk fast, free, and independent.