jdx/hk v2.7.0

v2.7.0: profile_condition for steps, new builtins, and per-repository logs and backups

on GitHub

hk 2.7.0 lets steps run based on and/or/not combinations of profiles, adds builtins for Herb, ansible-lint and Packer, and gives hk validate JSON output and a strict mode for CI. Logs, failure output and stash backups now live in each repository's git directory instead of one directory shared by every repository.

Added

• profile_condition for steps (#1684, @jdx). profiles only runs a step when every listed profile is enabled. profile_condition takes an expression, so you can write rules like "run when ci or slow is enabled". The new profile(name) function is true when a profile is enabled and not turned off with --profile !name. You can also use profile() in condition expressions.

  ["prettier"] = (Builtins.prettier) {
    profile_condition = "profile(ci) or (profile(slow) and not profile(fast))"
  }

  profile_condition applies on top of profiles, so existing configs work as before. Skipped steps report which profiles could enable them. If the expression is invalid, hk logs a warning and skips the step.

• hk validate --json and --deny-warnings (#1699, @jdx). --json prints one document on stdout, { "path": ..., "valid": ..., "warnings": [...] }, and stops logging warnings to stderr. --deny-warnings makes the command exit non-zero when the config has warnings. If you use both, hk prints the JSON first and then exits with the error. Invalid configs still fail as before.

• jactionlint builtin can fix files and covers more of them (#1687, @jdx). hk check prints one line per finding and turns each into an hk diagnostic. hk fix applies jactionlint's fixes: it uses the SARIF patch when every finding has a fix and falls back to jactionlint --fix when one doesn't. Besides workflows, the builtin now checks composite actions (.github/actions/**/action.y*ml) and .github/dependabot.y*ml. GitHub API checks stay off unless you pass --online or set JACTIONLINT_ONLINE. This needs jactionlint v2.

• Herb builtins (#1706, @beauraF). Builtins.herb_format (experimental) and Builtins.herb_lint format and lint HTML+ERB templates (*.html.erb, *.herb, *.html, *.rhtml, *.turbo_stream.erb and similar). hk init suggests them when it finds .herb.yml or the @herb-tools packages in package.json.

• ansible_lint builtin (#1707, @illesnagy1). This builtin lints Ansible playbooks, roles and collections in *.yml/*.yaml files. fix runs ansible-lint --fix and is skipped on Windows. hk init suggests the builtin when it finds .ansible-lint, .ansible-lint.y(a)ml, .config/ansible-lint.y(a)ml or ansible.cfg.

• packer_fmt builtin (#1708, @illesnagy1). This builtin formats *.pkr.hcl and *.pkrvars.hcl files with packer fmt. hk init suggests it when the project contains *.pkr.hcl files.

Changed

• Logs, failure output and stash backups are stored per repository (#1705, @jdx). Before, every repository and worktree shared ~/.local/state/hk. That meant a failure could point to an output.log containing another repository's output, and old-patch cleanup could delete another repository's backups. Inside a repository, the defaults are now:

  • hk.log and output.log in <git-dir>/hk/, separate for each checkout
  • stash backups in <common-git-dir>/hk/patches/, shared by linked worktrees

  HK_STATE_DIR, HK_OUTPUT_FILE and HK_LOG_FILE still take precedence. Runs outside a repository, and repositories that set core.sharedRepository, still use the platform state directory. When several repositories share an HK_STATE_DIR, patch cleanup no longer touches another repository's patches; for example, app no longer deletes app-web's. hk leaves existing files in ~/.local/state/hk in place but no longer uses them, so look there for backups made before upgrading.

Fixed

• Failed checks show readable findings instead of raw SARIF (#1695, @jdx). For steps with diagnostic_format = "sarif" or "eslint-json", the summary for a failed step now prints one line per finding, such as a.yml:3:2: error: no timeout [missing-timeout], instead of the tool's JSON. If hk can't parse any findings, it shows the raw output as before.
• brakeman builtin scans the whole Rails app (#1704, @beauraF). The builtin used to pass changed files as arguments, and brakeman read them as the application path. It now runs brakeman -q -w2 on the whole app.

New Contributors

• @beauraF made their first contribution in #1704

Full Changelog: v2.6.0...v2.7.0

💚 Sponsor hk

hk is built and maintained by @jdx, an open source developer at entire.io, the title sponsor of his open source work.

If hk speeds up your pre-commit loop or makes linting less painful, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep hk fast, free, and independent.