hk Updates & Release Notes

hk 2.8.0 adds builtins that format YAML with ryl format and a builtin for repositories that hold a global mise config. It also stops commit signing from breaking hk test, and updates the bundled TLS certificate crates after the eMudhra CA compromise.

Added

• ryl_format and ryl_markdown_format builtins (#1737, @jdx). Builtins.ryl_format formats YAML files. Builtins.ryl_markdown_format formats YAML front matter and fenced yaml/yml blocks in Markdown files. check runs ryl format --check, check_diff runs ryl format --diff, and fix runs ryl format. Set formatting options in the [format] table of .ryl.toml. These builtins need ryl 0.25 or later. The existing ryl and ryl_markdown linters work as before.

["ryl_format"] = Builtins.ryl_format
["ryl_markdown_format"] = Builtins.ryl_markdown_format

• mise_config_dir builtin (#1733, @jdx). This opt-in builtin formats a repository checked out at ~/.config/mise, for example one set up with mise bootstrap --adopt. It matches config.toml, config.*.toml, conf.d/*.toml, conf.d/*/mise.toml and conf.d/*/mise.*.toml. Each file goes through mise fmt --stdin, so files outside the repository are never touched. Builtins.mise is unchanged, which means repositories that use config.toml for other tools aren't affected. fix uses sh, so on Windows it needs a POSIX shell.

hooks { ["check"] { steps { ["mise"] = Builtins.mise_config_dir } } }

Fixed

• hk test passes when commit signing is turned on (#1735, @jdx). The tests for the no_commit_to_branch and destroyed_symlinks builtins create commits in a scratch repository. If your git config set commit.gpgsign without a signing key that applies to that repository, those commits failed and so did the tests. The test commits now turn signing off.

Security

• Compromised eMudhra intermediate CAs are no longer trusted (#1742, @jdx). rustls-webpki is updated to 0.103.16 and webpki-root-certs to 1.0.10. hk ships its own list of trusted root certificates, and the updated list stops trusting eight eMudhra intermediate certificates whose private keys were compromised.

Full Changelog: v2.7.1...v2.8.0

💚 Sponsor hk

hk is built and maintained by @jdx, an open source developer at entire.io, the title sponsor of his open source work.

If hk speeds up your pre-commit loop or makes linting less painful, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep hk fast, free, and independent.

Original source

hk 2.7.1 fixes the global pre-commit hook adding unstaged changes to commits. It also fixes spurious failures in the Vite+, oxfmt and standard_rb builtins, and makes hk init write a valid identifier for editorconfig-checker.

Fixed

• Global pre-commit hook now stashes unstaged changes (#1715, @jdx). The hook installed by hk install --global runs hk run pre-commit --from-hook --staged. Because --staged always turned stashing off, the hook ignored its stash setting, including the default stash = "git". If you staged part of a file with git add -p and a fixer then changed that file, the unstaged hunks ended up in the commit. When --staged is used together with --from-hook, hk now follows the hook's stash setting. HK_STASH is ignored in that case, so a global HK_STASH can't override a repository's stash = "none". Running hk run pre-commit --staged yourself still doesn't stash.
• vp_check, vp_fmt and vp_lint pass when no files match (#1716, @jdx). These Vite+ builtins now pass --no-error-on-unmatched-pattern, as the oxfmt builtin already does. Steps no longer fail when the Vite+ config ignores every staged file, and you don't need custom check/fix overrides for this.
• oxfmt skips lockfiles (#1717, @jdx). Commits that staged pnpm-lock.yaml or package-lock.json used to print oxfmt failed / Unsupported file type for stdin-filepath. The builtin now excludes both lockfiles from check, check_diff and fix.
• standard_rb respects .standard.yml exclusions (#1719, @beauraF). Standard ignores exclusions for paths passed to it directly, so hk could report offenses in excluded files. The builtin's check and fix commands now pass --force-exclusion, as the RuboCop builtin already does.
• hk init writes a valid editorconfig-checker step (#1726, @jdx). hk init --interactive used to write Builtins.editorconfig-checker, which Pkl can't resolve. It now writes ["editorconfig_checker"] = Builtins.editorconfig_checker. The picker now shows this builtin's category and description. hk builtins lists it as editorconfig_checker, the name you use in hk.pkl.

Full Changelog: v2.7.0...v2.7.1

💚 Sponsor hk

hk is built and maintained by @jdx, an open source developer at entire.io, the title sponsor of his open source work.

If hk speeds up your pre-commit loop or makes linting less painful, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep hk fast, free, and independent.

Original source

Added

profile_condition for steps (#1684, @jdx). profiles only runs a step when every listed profile is enabled. profile_condition takes an expression, so you can write rules like "run when ci or slow is enabled". The new profile(name) function is true when a profile is enabled and not turned off with --profile !name. You can also use profile() in condition expressions.

["prettier"] = (Builtins.prettier) {
profile_condition = "profile(ci) or (profile(slow) and not profile(fast))"
}

profile_condition applies on top of profiles, so existing configs work as before. Skipped steps report which profiles could enable them. If the expression is invalid, hk logs a warning and skips the step.

hk validate --json and --deny-warnings (#1699, @jdx). --json prints one document on stdout, { "path": ..., "valid": ..., "warnings": [...] }, and stops logging warnings to stderr. --deny-warnings makes the command exit non-zero when the config has warnings. If you use both, hk prints the JSON first and then exits with the error. Invalid configs still fail as before.

jactionlint builtin can fix files and covers more of them (#1687, @jdx). hk check prints one line per finding and turns each into an hk diagnostic. hk fix applies jactionlint's fixes: it uses the SARIF patch when every finding has a fix and falls back to jactionlint --fix when one doesn't. Besides workflows, the builtin now checks composite actions (.github/actions/**/action.yml) and .github/dependabot.yml. GitHub API checks stay off unless you pass --online or set JACTIONLINT_ONLINE. This needs jactionlint v2.

Herb builtins (#1706, @beauraF). Builtins.herb_format (experimental) and Builtins.herb_lint format and lint HTML+ERB templates (*.html.erb, *.herb, *.html, *.rhtml, *.turbo_stream.erb and similar). hk init suggests them when it finds .herb.yml or the @herb-tools packages in package.json.

ansible_lint builtin (#1707, @illesnagy1). This builtin lints Ansible playbooks, roles and collections in .yml/.yaml files. fix runs ansible-lint --fix and is skipped on Windows. hk init suggests the builtin when it finds .ansible-lint, .ansible-lint.y(a)ml, .config/ansible-lint.y(a)ml or ansible.cfg.

packer_fmt builtin (#1708, @illesnagy1). This builtin formats *.pkr.hcl and *.pkrvars.hcl files with packer fmt. hk init suggests it when the project contains *.pkr.hcl files.

Changed

Logs, failure output and stash backups are stored per repository (#1705, @jdx). Before, every repository and worktree shared ~/.local/state/hk. That meant a failure could point to an output.log containing another repository's output, and old-patch cleanup could delete another repository's backups. Inside a repository, the defaults are now:

• hk.log and output.log in <git-dir>/hk/, separate for each checkout
• stash backups in <common-git-dir>/hk/patches/, shared by linked worktrees

HK_STATE_DIR, HK_OUTPUT_FILE and HK_LOG_FILE still take precedence. Runs outside a repository, and repositories that set core.sharedRepository, still use the platform state directory. When several repositories share an HK_STATE_DIR, patch cleanup no longer touches another repository's patches; for example, app no longer deletes app-web's. hk leaves existing files in ~/.local/state/hk in place but no longer uses them, so look there for backups made before upgrading.

Fixed

Failed checks show readable findings instead of raw SARIF (#1695, @jdx). For steps with diagnostic_format = "sarif" or "eslint-json", the summary for a failed step now prints one line per finding, such as a.yml:3:2: error: no timeout [missing-timeout], instead of the tool's JSON. If hk can't parse any findings, it shows the raw output as before.

brakeman builtin scans the whole Rails app (#1704, @beauraF). The builtin used to pass changed files as arguments, and brakeman read them as the application path. It now runs brakeman -q -w2 on the whole app.

New Contributors

@beauraF made their first contribution in #1704

Full Changelog: v2.6.0...v2.7.0

💚 Sponsor hk

hk is built and maintained by @jdx, an open source developer at entire.io, the title sponsor of his open source work.

If hk speeds up your pre-commit loop or makes linting less painful, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep hk fast, free, and independent.

Original source

hk 2.6.0 adds builtins for Typst and jactionlint, detects more script types from their shebang, and ends passing runs with a success line when step output is shown. The agent stop hook no longer blocks in projects that don't use hk.

Added

Typst builtins (#1646, @jdx). Builtins.typstyle formats .typ files and Builtins.tinymist lints them. hk init detects both in Typst projects. In fix mode, hk applies the diff that typstyle prints. tinymist needs version 0.14.20 or newer. It checks each file separately, and the step still fails if an earlier file fails even when later files pass.

hooks {
["pre-commit"] {
fix = true
steps {
["typstyle"] = Builtins.typstyle
["tinymist"] = Builtins.tinymist
}
}
}

jactionlint builtin (#1663, @jdx). Builtins.jactionlint lints .github/workflows/*.yml and *.yaml with jdx/jactionlint, a maintained fork of actionlint. Its findings appear in hk check --sarif. The actionlint builtin is unchanged.

Success line after passing runs that show step output (#1678, @jdx). If every step passes but the end-of-run summary prints step output, such as stderr from a passing test, hk now ends with a line like ✔ check passed. The line isn't printed on failure or cancellation, with --quiet or --silent, in machine-output modes, or when no summary was shown.

More file types from shebangs (@jdx). These changes affect extensionless scripts selected with types:

Lua scripts are now typed lua, so stylua, selene and luacheck pick them up. Version numbers at the end of interpreter names are ignored, and luajit, pypy and nodejs map to their languages. For example, lua5.4 and luajit become lua, pypy3 becomes python, perl5 becomes perl and php8.2 becomes php (#1676).

Scripts with a deno or bun shebang are now typed deno or bun. They don't get a javascript or typescript tag, so a step needs to select them by name, for example types = List("deno", "bun"). node scripts are still typed javascript and node (#1680).

Fixed

hk agent stop-hook no longer blocks in projects without hk (#1649, @jdx). Claude Code and Codex Stop hooks set in user-level settings run in every project. In a project with no hk config, the hook used to block the agent's turn and tell it to run hk init. Now, if there's no config or the config has no check hook, the stop hook passes: it prints nothing for Claude Code and {} for Codex. A config that fails to load still blocks with its error.

The ryl builtin no longer prints a deprecation warning (#1655, @jdx). The builtin now runs ryl check for its check, diff, list-files and fix commands. ryl 0.20.0 doesn't have the check subcommand, so this needs a newer ryl. It was tested with 0.22.0 and 0.23.0.

Changed

Pkl config loading moved to pklr v5 (#1650, @jdx). Some config errors are worded differently. For example, some invalid regex patterns now fail while Pkl evaluates the config, with a message like "Syntax error in regex", instead of with hk's old validation message.

Documentation now explains when generated files are staged, how that relates to step output allowlists, and a limitation with HK_STASH_UNTRACKED=false for newly generated files (#1652, @zeitlinger).

Breaking Changes

If you use Builtins.ryl, upgrade ryl past 0.20.0 (0.22.0 or newer is verified). Older versions don't have ryl check, so the builtin fails with them.

Full Changelog: v2.5.0...v2.6.0

💚 Sponsor hk

hk is built and maintained by @jdx, an open source developer at entire.io, the title sponsor of his open source work.

If hk speeds up your pre-commit loop or makes linting less painful, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep hk fast, free, and independent.

Original source

Highlights

hk 2.5.0 makes stashing safe when hk is killed and when several hk processes run at once, loads configs much faster, and reports diagnostics from many more builtins. It also fixes a long list of cases where a check passed without checking anything, along with several Windows problems.

Stashing holds up under interruption and concurrency. SIGTERM, SIGHUP and crashes no longer leave your unstaged changes stuck in git stash. Hooks running in linked worktrees now take turns stashing. Several edge cases that dropped or mixed up changes are fixed.

Configs load faster. A cold config load drops from about 1.4 s to about 0.07 s, and hk validate is about 14x faster. Several per-step and stashing costs are lower in large repos.

Fewer checks pass when they should fail. hk validate now catches more config mistakes. Several builtins and hk util checks no longer skip binary files, case conflicts in directory names, or executable bits recorded in git.

Added

Diagnostics from more builtins. actionlint, flake8, revive, buf_lint, clang_format, mypy, mado, rumdl, ktlint, buildifier_lint, cpp_lint, xmllint and sorbet now feed hk check --sarif, --format json and the MCP dashboard. Their normal output doesn't change. (#1623, #1624, #1626, #1627, #1630, @jdx)

Broader gcc diagnostic format and a new diagnostic_severity step setting (#1629, #1630, @jdx). The gcc parser now reads:

lines with no column (path:line: message)

a vet: prefix and Go # pkg header lines

tool output that ends with a summary line, which is no longer added to the last finding

diagnostic_severity (error, warning, note or help; default error) sets the severity for rule-name: message findings that don't name one.

expect.diagnostics in step tests (#1622, @jdx). hk test can check that a step's diagnostic_format turns its output into the diagnostics you expect. Fields you leave out match anything, and message matches a substring.

tests {
  ["reports a warning"] {
    expect {
      code = 1
      diagnostics {
        new { path = "src/main.c"; line = 2; severity = "warning"; rule = "W1" }
      }
    }
  }
}

exec_ok() for step conditions (#1610, @jdx). exec_ok(command) is true when the command exits 0. Use it to gate a step on a shell test. exec() still returns stdout, and now gives a clear error instead of panicking on bad arguments or output that isn't valid UTF-8.

condition = "exec_ok('test -f check.js')"

MCP scope argument (#1600, #1640, @jdx). start_check, start_safe_check and start_safe_fix accept scope:

all (default): the whole project, as before

changed: staged, unstaged and untracked files

unstaged: unstaged and untracked files

staged: only files in the index

hk agent stop-hook (#1604, @jdx). The Stop hooks that hk agent hooks --target claude-code|codex generates now run this command. It runs hk run check --safe, always exits 0, and prints a valid {"decision":"block","reason":...} when the check fails. Before, the hooks printed raw JSON and exited with the linter's status, which the agents didn't handle. Regenerate your hook snippets to use it.

hk validate warnings (#1590, @jdx). hk validate now warns about:

misspelled properties, with a did-you-mean suggestion

depends entries that have no effect

steps with no command

globs that can never match, such as ./src/*.js, a leading /, ! patterns or comma-separated lists

min_hk_version now accepts v1.2.3 and two-part versions like 2.5.

hk init detects 47 more tools from their own config files or from manifest entries that name them. Examples include .flake8, stylua.toml, deno.json, .sqlfluff, .clang-format, [tool.isort] and typos. (#1576, @jdx)

Stash lock timeout. HK_STASH_LOCK_TIMEOUT (or git config hk.stashLockTimeout) sets how long hk waits for another hk process that is stashing. The default is 300 seconds, and 0 fails at once. (#1636, @jdx)

Changed

Cold config loads are about 20x faster. A config now evaluates only the builtins it uses, which cuts a cold load from about 1.4 s to about 0.07 s (#1581). The pklr 4.0 update makes hk validate on hk's own config about 14x faster (#1644). (@jdx)

Other speedups:

workspace_indicator is resolved once per directory, saving about 120 ms per step in large monorepos (#1599).

Runs that name their files, such as hk check FILE, skip the untracked-file scan (#1587).

Stashing no longer rescans the worktree first, saving about 80 ms on large repos (#1595).

Unchanged unstaged files are restored with one git process (#1612).

hk now uses the mimalloc memory allocator (#1635).

(@jdx)

Read-only checks run in parallel in fix hooks (#1586, @jdx). In fix hooks, steps that only have a check declared with effect = "read" now run side by side instead of one after another. They still wait for any fixer that writes the same files. The builtin mypy and tsc declare effect = "write", so they are not affected.

CRLF files stay CRLF in trailing_whitespace, newlines and mixed_line_ending (#1621, @jdx). trailing-whitespace strips only spaces and tabs, so it no longer strips form feeds or other Unicode whitespace. end-of-file-fixer appends the file's most common line ending. mixed-line-ending --fix converts to the file's most common line ending instead of always LF. On a tie it uses LF.

User config lists are merged with the project's (#1596, @jdx). skip_steps, skip_hooks and hide_warnings from the user config are now combined with the project's lists, as the docs describe. Before, the project's list replaced the user's.

hk now warns when hk.local.pkl doesn't amend hk.pkl, because the local file then replaces the shared config. Hide the warning with HK_HIDE_WARNINGS=local-config-replaces-shared.

Subproject skip_steps now apply to that subproject's own steps. hk now warns about other top-level subproject settings that have no effect. (#1615, @jdx)

Clearer error messages.

Failures print once, without Rust Location: lines. hk no longer suggests a fix command when the tool isn't installed. (#1588)

Argv steps say "command not found" when the tool is missing (#1579).

Pkl syntax errors show the file, line and column, including in imported files (#1598).

Hook '…' not found explains why: there is no hk.pkl, it's empty, or the name is wrong (it lists the defined hooks). hk init prints next steps. (#1564)

(@jdx)

Interrupted steps report cancelled. In structured output and MCP, a step or run stopped by Ctrl-C now reports cancelled instead of failed (#1643, @jdx).

Capped structured output. Each step's output in JSON, JSONL, MCP and JUnit results is limited to 64 KiB. JSON output now includes a failed run_result when hk fails before any step runs, for example on a broken config. (#1605, @jdx)

Fixed

Stashing

If hk is stopped by SIGINT, SIGTERM or SIGHUP (or a Windows console close), it restores stashed changes before exiting. After a crash or kill -9, the next hk run restores them if the working tree is clean. Otherwise it prints the git stash apply command to run. (#1641, @jdx)

hk processes in the same repository, including linked worktrees, now take turns stashing and restoring (#1636). hk restores its own stash entry by commit id, so other stash entries are never touched (#1637). (@jdx)

Stashing now handles these cases (@jdx):

A merge or cherry-pick in progress is kept (#1609).

A staged edit is kept when its worktree copy was reverted to HEAD (#1602).

Tracked files whose names start with : are stashed (#1614).

Unstaged text over a staged binary file is restored (#1580).

CRLF line endings are kept when unstaged files are restored (#1535).

Steps and file selection

Steps that depend on a step with no files now run instead of hanging (#1584).

Diagnostics from every job that started are kept when another job fails (#1642).

An exclude that names a directory now excludes the files in it (#1606).

Files are selected in directories whose names contain brackets or braces (#1592).

Tracked files whose names aren't valid UTF-8 are skipped with a warning in --all, --glob, --from-ref and file arguments (#1613).

Diagnostic paths are relative to the repository root for steps that run in a subdirectory (#1638).

Scripts whose env shebang uses -S, options or variables now get the right file type (#1611).

interactive = true steps run in hk's process group, so TUI tools such as fzf, helix and gimoji display correctly (#1557).

Formatter patches are applied and rolled back without interference from other commands or staging (#1392, @nettlesh).

Configuration and CLI

Top-level jobs in hk.pkl or the user config is now applied (#1594).

HK_STASH accepts true/1 and false/0, and an invalid value gives an error instead of a panic (#1594).

hk config no longer crashes when a setting is unset (#1594).

Dependency cycles, steps that depend on themselves, and invalid globs or regexes are rejected when the config loads, with the hook and step named. Before, hk check could hang. (#1567)

hk check --step with an unknown name now fails instead of passing after running nothing (#1603).

Configs that amend the v1 package schema load again (#1560).

Mirror credentials are hidden in errors from failed package downloads (#1620).

--help, --version and shell completion keep their normal exit code when the reader closes the pipe early (#1540).

Installed hooks

hk install --global records a path that still works after upgrades: the mise shim or the hk on PATH, not a versioned install path. Local hooks add hk's directory to the end of PATH, so they work in GUI git clients with a minimal PATH. (#1597)

The message for hk install --force-local when a global install exists is now correct (#1616).

Builtins and hk util

check_added_large_files and check_case_conflict now check binary files (#1571).

no-commit-to-branch works when a tag has the same name as the branch (#1577).

The executable and shebang checks use the file mode recorded in git, so they also work on Windows and with core.fileMode=false (#1577).

check-case-conflict finds conflicts between directory names, such as Foo/ and foo/ (#1577).

Text checks no longer skip files when the 8 KiB sample ends in the middle of a multibyte character. Key checks now also handle files that aren't valid UTF-8. (#1572)

fix-smart-quotes leaves files that aren't valid UTF-8, and symlinks, unchanged (#1570).

check-conventional-commit accepts merge and revert titles generated by git (#1566).

MCP and agents

cancel_run stops the hk run instead of staying in cancelling (#1607).

get_diff includes untracked and binary files and reports capture errors (#1601).

Windows

Percent signs in file names stay literal under cmd.exe (#1568).

Batches for cmd shims stay under the cmd.exe command-line length limit (#1618).

A custom shell runs directly, and quoted shell paths work (#1628).

Tools still running when a fail-fast cancel stops a run are now ended (#1625).

Security

hk check --safe and hk fix --safe now refuse a hook-level report whose effect is unknown or destructive. report accepts the same command forms as check, so you can declare its effect. (#1573)

Patches from check_diff that write inside .git, in any spelling git treats as .git, are refused, and hk runs the fixer instead. On Unix, hk creates new state directories with mode 0700. (#1585)

Legacy hk install (Git older than 2.54, or --legacy) no longer overwrites hooks that hk didn't write and no longer writes through symlinks; see Breaking Changes (#1593).

Breaking Changes

Legacy installs refuse to replace foreign hooks. If .git/hooks/ contains a hook that hk didn't write, or a symlink, hk install changes nothing and lists the files. Pass --force to replace them; a symlink's target is left untouched. Setups where another tool owns hooks, such as git lfs install, need hk install --force. Config-based installs on Git 2.54+ are not affected. (#1593)

Line-ending fixers keep CRLF. Repos that relied on trailing_whitespace or mixed_line_ending converting CRLF files to LF need another way to normalize line endings. (#1621)

Signal exit codes. When stopped by a signal, hk exits with 128 + signal: 130 for Ctrl-C (previously 1), 143 for SIGTERM and 129 for SIGHUP. Pressing Ctrl-C twice exits at once. (#1641)

Stricter config checks.

Dependency cycles and invalid step globs now fail when the config loads (#1567).

--step with an unknown name fails (#1603).

min_hk_version values such as "2.6" or "v2.6.0" are now enforced. Before, they were ignored. (#1590)

--safe and plain-string reports. A plain-string hook report blocks --safe runs. Declare it as a CommandSpec with effect = "read" to keep using it under --safe. (#1573)

Full Changelog: v2.4.0...v2.5.0

💚 Sponsor hk

hk is built and maintained by @jdx, an open source developer at entire.io, the title sponsor of his open source work.

If hk speeds up your pre-commit loop or makes linting less painful, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep hk fast, free, and independent.

Original source

In hk fix, many more builtins now apply their check_diff patch instead of running the tool a second time as the fixer. hk now applies those patches itself instead of calling git apply, and read-only check_diff commands can run in parallel with other steps that read the same files.

Added

hk util format-diff (#1514, @jdx). Builds an applicable patch from any formatter that reads stdin and writes the formatted file to stdout. It runs the formatter once per file, in parallel, and replaces {} with the file's path. It exits 1 with a patch when a file would change, and 0 when nothing would. If the formatter fails for any file or prints nothing for a non-empty file, it prints no patch, so hk runs fix and that reports the error. Use --no-stdin for formatters that read the file from its path.

check_diff = "hk util format-diff {{files}} -- stylua --stdin-filepath {} -"

hk util sarif-diff (#1515, @jdx). Runs a tool that reports fixes in a SARIF log and turns them into a patch. It prints a patch only when every result has a usable fix. If any result has no fix, or the tool fails, it prints no patch and hk runs fix. The findings exit code defaults to 1 and can be changed with --findings-exit-code.

check_diff = "hk util sarif-diff -- pinact run --check --format sarif {{files}}"

run = "diff" step tests (#1518, @jdx). A diff test runs check_diff and applies its output the way fix mode does. If the patch doesn't apply, the test fails instead of falling back to fix. If the step sets check_after_diff, the test reruns check after the patch applies. TestMaker gains diffPass and diffFail. Every builtin with a check_diff now has a diff test.

Warning when a check_diff patch doesn't apply (#1517, #1520, @jdx). Before, hk ran the fixer without saying why. It now prints a warning that names the file and hunk, for example fmt: check_diff printed a patch that doesn't apply, so the fixer ran instead: test.txt: error applying hunk #1. Output that isn't a patch still only shows at debug level.

Changed

More builtins apply patches in fix mode instead of running the tool twice (@jdx):

stylua, yamlfmt, taplo_format, tombi_format, buildifier_format, terraform and tofu now use hk util format-diff (#1514). For stylua, yamlfmt, taplo_format and tombi_format, the old non-patch diff view is now their check, so hk check output doesn't change. The yamlfmt and taplo patch scripts need a POSIX shell. On Windows those two steps run the fixer instead.

ruff, oxfmt, shellharden and go_lines gain a check_diff (#1516). After ruff applies its patch, it reruns ruff check so issues it can't fix are still reported.

pinact and pinact_update apply pinact's SARIF fixes, which also avoids a second round of GitHub API calls (#1515).

isort gains a check_diff, and gomod_tidy patches now apply (#1513).

trailing_whitespace and newlines now apply their diffs instead of setting apply_check_diff = false (#1528).

selene and zizmor no longer run their tool twice in fix mode (#1511).

hk applies check_diff patches itself instead of running git apply (#1520, @jdx). Patches still apply all or nothing, with exact context matching. Existing files are written in place, so they keep their permissions and owner. If a write fails, hk restores the files it changed. Patches whose header labels one side with a temporary file or a label now apply, such as those from buildifier -mode=diff and phpcs --report=diff. hk refuses the following patches and runs the fixer instead:

• paths outside the working directory
• paths through symlinks
• files with other hard links
• renames, copies and mode changes
• binary patches

Read-only check_diff steps run in parallel (#1519, @jdx). When a step's check_diff declares effect = "read", hk computes the patch under read locks. It takes write locks only on the files the patch names. If another step wrote any of the job's files in the meantime, hk recomputes the patch. On an already-formatted tree, two such steps over the same files now run at the same time instead of one after the other. 28 of the 30 builtin check_diff commands declare a read effect. A check_diff that declares effect = "read" must now really only read the step's files.

Steps with an argv prefix or custom shell no longer fail to load because of a shell-based check_diff or check_list_files (#1514, @jdx). hk skips that command, and anything that depends on it, and runs check and fix instead. As a result, yamlfmt, taplo_format, black and ruff now load with a prefix such as prefix = List("mise", "x", "--"). A check or fix that can't run with the prefix is still an error.

go_lines accepts an argv prefix (#1523, @jdx). Its shell check wrapper is gone. As a result, hk check now shows the patch golines would apply instead of a list of files.

Fixed

More check_diff patches apply (#1513, #1528, @jdx). Before, these patches were rejected and hk ran the fixer:

• go mod tidy -diff's current//tidy/ headers
• isort's :before/:after labels
• hunk lines that look like ---/+++ headers
• changes to lines with CRLF endings
• file names containing tabs, which diff headers now quote the way git does

Files created by check_diff patches are staged (#1524, @jdx). For example, when go mod tidy -diff creates go.sum, hk no longer warns that the file is outside the job. stage = "" now stages the new file in pre-commit.

No frozen spinner left after check_diff jobs (#1530, @jdx). In an interactive terminal, a read-locked check_diff step could leave a stale spinner, its command, and its last line of output under the finished step.

Concurrent hk install runs are reliable (#1533, @jdx). Local install and uninstall now hold a lock while they update the hook.hk-* git config entries, including across linked worktrees. Before, concurrent runs could fail on a missing key or git's config lock and leave hooks half-installed. Fixes #1531.

Full Changelog: v2.3.1...v2.4.0

💚 Sponsor hk

hk is built and maintained by @jdx, an open source developer at entire.io, the title sponsor of his open source work.

If hk speeds up your pre-commit loop or makes linting less painful, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep hk fast, free, and independent.

Original source

hk now starts faster, spends less of its own time per file, and spreads --jobs more evenly across batched steps. This release also fixes several cases where stashing could lose files, fail before any step ran, or leave untracked files visible to steps.

Added

apply_check_diff step setting (#1495, @jdx). Defaults to true. If you set it to false, hk fix runs the step's fix command instead of applying the check_diff output, and hk check still shows the diff. In staging hooks such as pre-commit, hk still runs check_diff first and passes fix only the files the diff names. The trailing_whitespace and newlines builtins now use it. Together with a parallel file scan in hk util trailing-whitespace and hk util end-of-file-fixer, this roughly halves the time of those two steps on a whole-repo fix.

["my-fixer"] {
check_diff = "my-fixer --diff {{files}}"
fix = "my-fixer --write {{files}}"
apply_check_diff = false
}

Changed

Every command starts sooner. hk now reads the config cache files in one call instead of one byte at a time, which cuts about 30 ms from every command that loads a config (#1483). Hooks read the repository status with a single git status --porcelain=v2, which saves about 10 ms more (#1484). The Linux GNU release binaries are now linked non-PIE, so each launch starts about 0.8 ms faster (#1482). The tradeoff is that ASLR no longer covers hk's own code and data. The heap, stack and shared libraries are still randomized. musl, macOS, Windows and cargo install builds are unchanged. (@jdx)

Batched steps share --jobs (#1496, @jdx). Before, every step with batch = true in a group started up to --jobs processes on its own. With 8 jobs, the benchmark ran 40 processes for 8 slots. Batched steps that run at the same time now split the jobs between them: each step gets an equal share first, and leftover jobs go to the steps with the most files. A group with a single batched step still gets every job, and steps with depends or condition keep every job. On the benchmark, hk check --all used about 20% less CPU. Nothing needs to be configured.

Fix runs are faster and more consistent.

A fixer no longer waits behind a job that shares none of its files. hk now gives a job all of its file locks at once or none of them. On the benchmark, the spread in hk fix --all fell from ±207 ms to ±30 ms (#1503).

Steps that finish together stage their fixes with one git add (#1485).

hk no longer hashes the whole git index before each step stages its fixes (#1486).

hk does less work per file before a step starts: faster file locks, parallel type, binary and symlink checks, and one lstat per file (#1494).

hk parses check_diff output without canonicalizing every file (#1487). If allow_symlinks puts both a symlink and its target in the same job, a diff that names one of them now selects only that path.

(@jdx)

jq and yq builtins check already-formatted files in one batch (#1489, @jdx). Before, they started the tool and diff once per file. On the benchmark, the jq check step went from 736 ms to 52 ms. Files that can't be confirmed as formatted this way still get the old per-file check, so patches, exit codes and error messages stay the same.

Small changes to git.* status lists (#1484, @jdx). These lists now match git's own status in three edge cases:

• Sparse-checkout entries missing from the worktree are no longer listed in git.unstaged_deleted_files.
• An intent-to-add file that was then deleted is no longer listed in git.staged_added_files.
• With HK_STASH_UNTRACKED=false, a submodule whose only change is untracked files no longer counts as unstaged.

Building from source now requires Rust 1.94 (#1502, @jdx). This includes cargo install hk. Prebuilt binaries are unaffected.

Fixed

Stashing no longer loses files when a filename is not valid UTF-8 (#1488, @jdx). With stash = "git", one such name could make hk restore nothing and then drop the stash, deleting untracked and unstaged files. hk now skips these paths with a warning and still stashes and restores them.

Restoring now uses the stash commits directly. This fixes two gaps: a staged edit later reverted to HEAD, and an unstaged deletion stashed together with untracked files.

When a step changed a path the stash also changed, hk keeps the stash and prints a git restore command for each path it didn't restore.

Hooks run when the index has intent-to-add files (#1492, @jdx). With stashing on, a git add -N entry made hk run pre-commit and git commit fail with Entry '...' not uptodate. Cannot merge.. hk now saves these files in a separate stash entry, hides them from steps, and restores them afterwards as intent-to-add. If hk is killed during a hook, the entry appears as hk: intent-to-add files in git stash list.

Untracked files are hidden from steps when tracked files also have unstaged changes (#1501, @jdx). Before, in that case, steps could read, overwrite or stage untracked files. hk now stashes the whole worktree whenever there are untracked files to stash.

git commit works in repositories with core.splitIndex = true (#1491, @jdx). Before, the hook failed with failed to get index because libgit2 can't read a split index. hk now falls back to shell git in these repositories.

Amended steps whose tests use a local named like a StepTest property now load (#1490, @jdx). Before, a local named, for example, after or files failed with invalid type: null, expected a string once the step was amended. hk now uses pklr 3.0.1, which fixes this.

Full Changelog: v2.3.0...v2.3.1

💚 Sponsor hk

hk is built and maintained by @jdx, an open source developer at entire.io, the title sponsor of his open source work.

If hk speeds up your pre-commit loop or makes linting less painful, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep hk fast, free, and independent.

Original source

Staging hooks such as pre-commit now stage each fixer's files as soon as that fixer finishes, and hk fix --all makes better use of --jobs. This release also adds a batch_min_files step setting and fixes the jq/yq builtins, stashing before the first commit, and an intermittent git crash during concurrent staging.

Added

batch_min_files for batched steps (#1475, @jdx). Steps with batch = true can set the minimum number of files hk passes to one process. The default is still 4. Raising it means fewer processes, which helps tools with slow startup, such as prettier and eslint, on whole-tree runs. In hk's benchmark, batch_min_files = 200 on prettier and eslint cut hk check --all from 1.56 s to 1.33 s. It made a small pre-commit a little slower, so the builtins' defaults are unchanged. OS command-length limits can still split a batch below this number.

steps {
["prettier"] = (Builtins.prettier) {
batch_min_files = 200
}
}

Changed

Staging hooks are faster (#1466, @jdx). Before, each fixer waited for every other step to finish before staging its changes. Now each step stages its own files as soon as nothing else is using them. Steps with check_list_files or check_diff (such as builtin black and prettier) also stopped running their check before the fix in staging hooks. They still check first when one of their files has unstaged changes that hk didn't stash. Explicit stage = "<JOB_FILES>" and check_first = true work as before. Staging now always goes through git add, including with libgit2. git add reads paths from stdin, so very large fixes can't go over the command-line length limit, and it applies clean filters such as git-lfs. On the benchmark's 62-file commit, hk run pre-commit went from about 0.89 s to 0.45 s.

hk fix doesn't hold job slots while waiting on file locks (#1473, @jdx). A fixer waiting on another fixer's files now gives up its --jobs slot while it waits, so steps that work on other files can run in the meantime. On the benchmark project, hk fix --all went from 4.72 s to 4.08 s with the same output.

More release binaries use profile-guided optimization (#1470, @jdx). The x86_64 Linux musl and macOS arm64 builds are now built with PGO, which only the x86_64 Linux glibc build had before. Archive names and layout are unchanged.

Fixed

jq and yq builtins apply their own patches (#1468, @jdx). The patches from check_diff had a bad file label, so git apply rejected them and hk ran the tool again. hk now applies the patch directly, which roughly halves the time for these steps.

If a file can't be parsed (for example, JSONC or broken YAML), hk leaves it unchanged instead of emptying it, and hk fix exits non-zero.

jq's fix now keeps file permissions and fails when jq fails.

jq's check now sorts keys the same way its fix does, so hk check now fails on JSON files with unsorted keys that it used to pass.

Stashing in a repository with no commits yet (#1469, @jdx). With the git CLI backend (HK_LIBGIT2=0), a hook that stashes unstaged changes failed in a repository with no commits because git stash errored. hk now skips the stash when HEAD doesn't exist, as the libgit2 backend already did.

Intermittent "terminated by signal" failures during staging (#1476, @jdx). In a staging hook, git status or git add could crash with SIGBUS while another step was rewriting a different file, and could sometimes leave behind a stale index.lock. hk now runs git status with GIT_OPTIONAL_LOCKS=0. Before staging, it also locks any recently changed files that git might re-read while writing the index.

Full Changelog: v2.2.0...v2.3.0

💚 Sponsor hk

hk is built and maintained by @jdx, an open source developer at entire.io, the title sponsor of his open source work.

If hk speeds up your pre-commit loop or makes linting less painful, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep hk fast, free, and independent.

Original source

Fix steps now run their fixer directly instead of checking first, and batch steps start fewer processes on small commits. Together these make hk run pre-commit about a third faster on a typical fixture. This release also adds JUnit XML output, hook arguments in conditions, and a hk migrate pre-commit that produces a working config right away. It fixes a staging race between concurrent fixers and a stale config cache when Pkl reads environment variables.

Added

• --junit-xml <PATH> for hk check, hk fix and hk run <hook> (#1432, @sanga). Writes one JUnit <testcase> per step, with its status, duration and captured output, so CI systems such as Jenkins can show hk results. It works alongside --sarif, whatever output format you choose. If a run fails before any step is planned, the report still contains a failing test case, so it doesn't look like a passing build.

• Git hook arguments in condition and step_condition (#1445, @jdx). Conditions can now use the hook variables that command templates already had: prev_head, new_head and is_branch_checkout (post-checkout), commit_msg_file (commit-msg, prepare-commit-msg), source and sha (prepare-commit-msg), hook_stdin (pre-push, post-rewrite), and hook_args (all hooks). Conditions are expr-lang expressions, so write is_branch_checkout, not {{ is_branch_checkout }}.

  hooks {
  ["post-checkout"] {
  steps {
  ["install-deps"] {
  step_condition = "is_branch_checkout"
  check = "mise install"
  }
  }
  }
  }
  

• hk migrate pre-commit produces a working config (#1459, @jdx).

• Hooks from 34 well-known repos (66 hook ids) become hk builtins, unless they set args, files, types or other options the builtin can't reproduce.

• Local system, script and fail hooks become native steps with their command, filters and stages kept.

• Every other hook becomes a precommit("id", "stage") step that runs through prek or pre-commit, with a comment explaining why it wasn't converted. Pick the tool with the new --runner prek|pre-commit flag. The default is prek, unless only pre-commit is on PATH.

• Hooks go into the matching git stage. manual hooks run only with hk check and hk fix.

• Pre-commit's top-level exclude and fail_fast settings are honored.

• The legacy commit stage now maps to pre-commit instead of commit-msg.

• Keep .pre-commit-config.yaml until every delegated step is converted, because those steps still read it. Delegated steps use the same command for check and fix, so hk check can modify files for them, just as pre-commit run does. The migration no longer clones hook repos into .hk/vendors/.

• New builtins Builtins.renovate_deps and Builtins.lychee_extended (#1448, #1449, @zeitlinger). Both run Flint's checkers on the files hk selects. renovate_deps checks the Renovate dependency snapshot (.github/renovate-tracked-deps.json) and regenerates it in fix mode. It requires flint and renovate. lychee_extended checks links in text files and remaps links to the same repository in PRs. It requires flint and lychee.

• svelte, vue and astro file types (#1428, @nettlesh). .svelte, .vue and .astro files are now tagged text plus their own type, so steps can select them with types = List("svelte", "vue") instead of globs. These tags don't imply html, javascript or typescript.

• hk init finds source files in subdirectories (#1403, @zeitlinger). Detection respects .gitignore (or .ignore outside git), includes hidden files and doesn't follow symlinks. For example, nested shell scripts and BUILD.bazel files now enable the matching builtins. Manifest and config indicators such as Cargo.toml still count only at the repository root.

• hk init detects native Biome and ESLint config files (#1402, @zeitlinger), including biome.jsonc, flat eslint.config.* and legacy .eslintrc*. Projects no longer need matching package metadata to get these steps.

• cargo-fmt builtin watches rustfmt.toml and .rustfmt.toml (#1446, @sanga), so changing rustfmt settings reruns the step.

Changed

• check_first now defaults to false (#1461, @jdx). Before, when several fixers wrote the same files, each ran its check and then ran fix only if the check failed. Files that needed fixing were processed twice (eslint, then eslint --fix). Steps now run fix directly. Set check_first = true on a slow fixer whose files usually pass already. hk still checks first on its own in these cases:

  • steps whose check and fix are the same command (pre-commit-style fixers). A single fixer like this now passes after fixing, even when no other step touches its files.
  • check_diff steps in fix mode.
  • check_diff or check_list_files steps in hooks that stage fixes. These fix and stage only the files that need it.

  On a benchmark with about 6,000 files and ten fixers, together with the batching change below, hk run pre-commit dropped from 1,442 ms to 965 ms and hk fix --all from 5,959 ms to 4,568 ms.

• Batch steps run at least 4 files per process (#1458, @jdx). hk used to split files into files / jobs chunks, which on small commits meant one process per file. It now makes min(jobs, files / 4) batches and splits files evenly across them, like pre-commit and prek. For example, 5 files on 8 jobs run as a single process. Large file sets are split the same way as before.

• Faster black, jq and yq builtins (#1454, @jdx). black no longer passes --diff, which bypassed black's cache. On about 4,000 formatted files the step went from roughly 7–9 s to 0.8 s. Failures now show black's would reformat lines instead of a diff. jq and yq now set batch = true, so their files are split across jobs.

• Top-level exclude from user config and project config now combine (#1460, @jdx). If ~/.config/hk/config.pkl and hk.pkl both set exclude, the project value used to replace the user value, which contradicted the docs. Both now apply.

Fixed

• Staging no longer fails or stages half-written files when fixers overlap (#1453, @jdx). When several fixers rewrote the same files in parallel, hk run pre-commit could fail with errors like failed to add files to index … file changed before we could read it, index.lock: File exists, or could not find '…' to open, and could stage partial content. Staging now waits until every step writing those files is done.

• Config cache follows environment variables read by Pkl (#1450, @christopher-buss). A config that branched on read?("env:..."), such as setting profiles when CLAUDECODE is set, kept whatever result the first run cached. The cache is now keyed on the value of every environment variable the evaluation read, including unset ones. The first run after upgrading misses the cache.

• A Regex for top-level exclude now loads (#1460, @jdx). exclude = Regex(#"^vendor/|.gen."#) used to fail with data did not match any variant of untagged enum StringOrList. It now works like a step-level regex exclude. An invalid pattern fails hk validate. Top-level excludes also now apply to file arguments written as absolute paths or with .. segments.

• yq fix no longer merges several files into the first one (#1452, @jdx). yq -iP a.yml b.yml writes both documents into a.yml and leaves b.yml unchanged. The builtin now fixes each file separately.

• check_list_files works with a step's dir (#1454, @jdx). Paths printed relative to dir used to match nothing, and the fix aborted with check_list_files failed with no files in output. This affects prettier, gofmt, black and any other step using check_list_files.

• Templates and XML files with unknown extensions count as text (#1427, @nettlesh). Files starting with an HTML-like tag (such as script.tmpl) or an XML declaration (such as App.csproj) were tagged binary, so types = List("text") steps skipped them. They are now tagged text, and XML files also get xml.

• Closed output pipes no longer crash hk (#1442, @jdx). Commands like hk --version | true, a pager you quit early, or a cancelled shell completion used to panic with SIGABRT and leave a core dump. hk now exits like a program killed by SIGPIPE (status 141), with no panic output.

• hk init --mise keeps an existing mise.toml (#1404, @zeitlinger). It now adds only missing hk and pre-commit entries and keeps existing pins, comments, tools and task definitions. It doesn't add a pre-commit task when an included task file already defines one. --force now affects only hk.pkl.

New Contributors

• @sanga made their first contribution in #1432
• @christopher-buss made their first contribution in #1450

Full Changelog: v2.1.0...v2.2.0

💚 Sponsor hk

hk is built and maintained by @jdx, an open source developer at entire.io, the title sponsor of his open source work.

If hk speeds up your pre-commit loop or makes linting less painful, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep hk fast, free, and independent.

Original source

Added

Glob imports in hk configuration (#1423, @jdx). The expression form import*("generated/.pkl") now evaluates; hk previously rejected it at parse time with unexpected token in expression: KwImportStar, which kept projects that generate step definitions on hk 1.x. The declaration form import "generated/*.pkl" as generated continues to work. Support comes from upgrading hk's bundled Pkl evaluator to pklr 3.0.

local generated = import*("generated/*.pkl")
hooks {
  ["check"] {
    steps = new Mapping<String, Step> {
      for (_, mod in generated) {
        ...mod.STEPS
      }
    }
  }
}

Each matched file exports its own STEPS: Mapping<String, Config.Step>. See the new "Import many files at once" section in the Pkl introduction docs.

Builtins.kube_linter (#1394, @zeitlinger). Runs kube-linter lint --fail-if-no-objects-found on plain Kubernetes manifests in conventional k8s, kubernetes, manifests, deploy, and deployments directories, excluding Helm templates/, values*.yaml, and kustomization.yaml. It checks deployment policy rather than schemas, so it complements kubeconform; native .kube-linter.yaml / .kube-linter.yml config is discovered automatically. Override glob for other layouts. Helm charts are out of scope and there is no fix command because the tool has none.

Builtins.dotnet_format (#1393, @zeitlinger). Checks and fixes C# and Visual Basic formatting with dotnet format, passing hk's selected files via --include and relying on dotnet's project/solution discovery in the working directory. Set dir = "src/app" for a nested project or solution and use separate steps for independent directories. The step is exclusive and both commands declare a write effect because restore can touch obj/. Requires .NET SDK 6+ and trusted project code, as with running dotnet format directly.

steps {
  ["dotnet-format"] = Builtins.dotnet_format
}

editorconfig-checker can now fix (#1397, @lucacome). The builtin gains a fix command using editorconfig-checker --fix when version = "4" (the default); version 3 remains check-only.

Fixed

Config cache picks up import changes it used to miss (#1422, @jdx). hk keyed its cached module-graph analysis on the root hk.pkl alone, so adding or removing a file matched by an import* glob, or an imported module gaining a new import, was ignored until you edited hk.pkl or ran hk cache clear. The analysis now records glob patterns and a digest of every source in the graph and re-validates both before reuse. No settings or config changes are needed; caches from older hk versions are not reused. #1423 also fixes untracked-import detection so a remote module loaded with an expression-form import(...), with its URI on a following line, or after a comment is no longer mistakenly served from the shared cache.

typos no longer reports success on failure under custom shells (#1398, @zeitlinger). With a shell that does not enable errexit (for example shell = "sh -c"), a failing typos run such as an unreadable or invalid typos.toml could fall through to the empty-output success path. The builtin now preserves the command's exit status. The default hk shell was already unaffected.

pre-push warns on malformed stdin instead of panicking (#1352, @connormharris). When hk inherits a non-terminal stdin, for example inside a while read branch loop, lines that are not crashed with index out of bounds. Such lines are now skipped with Ignoring malformed stdin line "...": , and the two SHA fields must be full 40- or 64-character lowercase hashes.

New Contributors

@connormharris made their first contribution in #1352

@zeitlinger made their first contribution in #1398

@lucacome made their first contribution in #1397

Full Changelog: v2.0.1...v2.1.0

💚 Sponsor hk

hk is built and maintained by @jdx, an open source developer at entire.io, the title sponsor of his open source work.

If hk speeds up your pre-commit loop or makes linting less painful, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep hk fast, free, and independent.

Original source

The Terragrunt builtins now catch errors in shared HCL files, kubeconform can be retargeted without breaking its bundled tests, and hk test explains itself when a step's filters exclude every file a test writes. Note that the Terragrunt builtins now require terragrunt 1.0.8 or newer.

Fixed

terragrunt_hcl_validate catches errors in shared HCL includes (#1371, @sassdavid). Previously the step ran --working-dir once per selected directory, so editing a shared file outside every unit directory (one reached only via include or read_terragrunt_config) validated nothing and passed. Both terragrunt_hcl_validate and terragrunt_hcl_fmt now run a single terragrunt process scoped with --filter; validate adds a directory filter and a reading= filter per selected file so unit configs and shared includes are both covered. On a 39-unit repository this cut fmt from 1650ms to 91ms and validate from 5680ms to 1475ms. Requires terragrunt 1.0.8+, the first release where --filter works on hcl fmt and hcl validate.

hk test reports when a step's filters exclude a test's files (#1373, @sassdavid). When a test omits files, hk derives them from the test's write keys and applies the step's glob/types/exclude/match_any filters. If nothing survived, the command still ran with an empty file list and failed in a tool-specific way (for example kubeconform complaining about stdin). The test now fails up front with the step's file filters excluded all N file(s) written by this test; set the test's files explicitly, or reset tests when overriding a builtin's glob. Tests that set files, write nothing, or belong to steps without filters are unaffected, and code= is now only printed when a command actually ran.

Pkl evaluator update: hk's bundled Pkl evaluator (pklr) moves from 2.0.1 to 2.0.4, which preserves lexical scope across object amendments and keeps field-pruned import views intact while evaluating object and mapping amendments (#1380, #1381).

Changed

kubeconform gains dirs, test_dir, and extra_excludes (#1372, @sassdavid). Replacing the builtin's glob to cover layouts such as Flux's apps/ or clusters/ used to filter away every file its own tests wrote, forcing users to delete the inherited tests block. The builtin now derives its glob, excludes, and test paths from three options; defaults are unchanged.

steps {
["kubeconform"] = (Builtins.kubeconform) {
dirs = List("apps", "clusters") // List() selects every YAML file
extra_excludes = List("**/custom.yaml") // appended to the Helm/kustomize defaults
}
}

Set test_dir when replacing glob outright so the bundled tests still write into a selected path. Prefer extra_excludes over exclude, which replaces the defaults and re-admits Helm templates/, values.yaml, and kustomization.yaml files.

Documentation

Global mise hook installation is now the recommended setup (#1376, @jdx). On Git 2.54+, hk install --global --mise installs the launcher once per machine, records mise's path at install time, and is a no-op in repositories without hk configuration. hk install --mise remains documented for repository-scoped installs on any supported Git version but needs mise on Git's runtime PATH. To switch scopes, run hk uninstall then hk install --global --mise. The mise postinstall = "hk install --mise" recipe is removed from the main setup flow.

Top-level steps is optional (#1370, @jdx). The v2 migration guide no longer reads as if moving steps to the top level is required; hook-only configurations and shared local mappings remain supported. The README, getting started, configuration, Pkl guides, and downloadable examples now use a single steps { ... } block, and staging guidance reflects that hk fix leaves changes unstaged unless --stage is passed.

Full Changelog: v2.0.0...v2.0.1

💚 Sponsor hk

hk is built and maintained by @jdx, an open source developer at entire.io, the title sponsor of his open source work.

If hk speeds up your pre-commit loop or makes linting less painful, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep hk fast, free, and independent.

Original source

Highlights

hk 2.0 simplifies configuration around a single shared steps map, stages fixed files only in pre-commit by default, turns builtin variants into typed options, and removes the deprecated v1 configuration files and entry points. Upgrading requires reviewing your hk.pkl; see Breaking Changes below and the v2 migration guide.

Less repetition in hk.pkl: a top-level steps block now defines the check, fix, and pre-commit hooks at once, and builtin variants such as gitleaks_staged or pinact_v3 are replaced by options on the primary builtin (#1255, #1253).

Predictable staging: only pre-commit stages fixes automatically; hk fix and custom hooks leave the index alone unless you ask (#1256).

Pkl only: hk.toml/yaml/json, .hkrc.pkl, UserConfig.pkl, hk generate, and the external pkl CLI fallback are gone; hk reports a targeted replacement for each removed input (#1257).

Nine new builtins for Terraform, Terragrunt, Kubernetes, Markdown, and repository hygiene, plus fixes to rubocop, tf_lint, and zizmor.

Breaking Changes

Shared top-level steps and hook defaults (#1255, @jdx)

A top-level steps map materializes implicit check, fix, and pre-commit hooks, so the common "define linters once, wire them into three hooks" pattern collapses to:

amends "package://github.com/jdx/hk/releases/download/v2.0.0/[email protected]#/Config.pkl"
import "package://github.com/jdx/hk/releases/download/v2.0.0/[email protected]#/Builtins.pkl"
steps {
  ["prettier"] = Builtins.prettier
  ["eslint"] = Builtins.eslint
}

Defaults: check runs checks without fixing or staging, fix applies fixes without staging, and pre-commit fixes, stages, and uses Git stashing. No implicit pre-push is created. An explicit hook with one of these names keeps its own hook-level settings and replaces same-named inherited steps; the remaining shared steps still apply. Hooks gain enabled = false to skip a hook at run time and omit it from hk install. hk init and hk migrate pre-commit now emit this shorter form. In monorepos, subproject configs contribute steps only; explicit hook-level settings in a subproject are ignored with a debug message.

Staging is contextual (#1256, @jdx)

Previously fixed files were staged for every hook. Now only pre-commit stages by default; hk fix, check, and custom hooks leave the index untouched unless stage = true is set on the hook or --stage / HK_STAGE / git config hk.stage is supplied. Precedence is CLI and settings, then the hook's stage, then the hook-name default. A step's stage patterns are now pure path filters: they narrow what gets git added once hook-level staging is on, and never enable staging by themselves. Scripts that relied on hk fix staging its changes should pass --stage.

Builtins are flat, configurable steps (#1253, @jdx)

Every builtin is a plain Config.Step; default references such as ["prettier"] = Builtins.prettier are unchanged. The separate variant exports are removed in favor of typed options amended on the primary builtin:

Removed

Replacement

Builtins.gitleaks_staged

(Builtins.gitleaks) { scan = "staged" }

Builtins.knip_strict

(Builtins.knip) { strict = true }

Builtins.pinact_v3, Builtins.pinact_update_v3

(Builtins.pinact) { version = "3" }, (Builtins.pinact_update) { version = "3" }

Builtins.check_byte_order_marker, Builtins.fix_byte_order_marker

Builtins.byte_order_marker

Generic step customization (batch, glob, depends, ...) goes in the same amended object. hk's embedded evaluator is upgraded to pklr 2.0.1.

Deprecated v1 interfaces removed (#1257, @jdx)

hk now loads Pkl configuration only. Removed inputs fail with an error that names the replacement and links to the migration guide:

Removed in v2

Replacement

hk.toml, hk.yaml, hk.yml, hk.json

hk.pkl amending Config.pkl

project .hkrc.pkl

hk.local.pkl

home ~/.hkrc.pkl, --hkrc <PATH>

~/.config/hk/config.pkl

UserConfig.pkl (and its environment { }, defaults { })

Config.pkl with env { } and top-level settings

Types.Regex(...), Config.Regex(...)

Pkl's built-in Regex(...)

hk generate

hk init

HK_PKL_BACKEND=pkl

remove it; pklr remains an accepted no-op

.config/hk.pkl, .config/hk.local.pkl, and XDG config.pkl continue to work. Global XDG hooks merge additively into project hooks (adding env, a missing report, and non-conflicting steps) without overriding project execution settings. The hk runtime no longer invokes the pkl CLI, directly or through mise; the built-in pklr evaluator is always used.

Added

Terraform and Terragrunt builtins (@sassdavid) #1362, #1363. terraform_docs (checks with --output-check, writes and stages the README on fix) and terraform_validate (runs terraform init -backend=false only when validation fails) operate per module directory derived from the selected files. terragrunt_hcl_fmt and terragrunt_hcl_validate run from the working directory since terragrunt hcl fmt --file accepts one path. hk migrate pre-commit maps terraform_docs, terraform_validate, and terragrunt_fmt.

kubeconform builtin (@sassdavid) #1363. Validates Kubernetes manifests; it globs all YAML, so narrow glob to your manifest paths if the repository holds unrelated YAML.

mado Markdown linter (@hituzi-no-sippo) #1349. Check-only builtin for the Rust CommonMark/GFM linter.

Repository hygiene checks (@sassdavid) #1360. New destroyed_symlinks (symlink in HEAD staged as a regular file), forbid_submodules (gitlinks in the index), and check_shebang_scripts_are_executable builtins, each also available as hk util <name>. hk migrate pre-commit maps the matching pre-commit ids, including forbid-new-submodules.

Release archives ship agent skills and completions (@jdx) #1337, #1336. Every release archive includes hk-configure and hk-debug skills under skills/, and native bash, zsh, fish, and PowerShell completion scripts are published as release assets. Both are declared in the signed packslip manifest so mise-compatible installers can use them without usage or a separate setup step.

Fixed

rubocop and rubocop_server now fix and block offenses (@andyw8) #1355. check_list_files used --list-target-files, which always exits 0, so hk skipped the check/fix commands. It now uses rubocop --format files.

tf_lint lints every module directory (@sassdavid) #1361. tflint was invoked without arguments and only linted the current directory. It now runs --chdir for each directory derived from the selected files, treats tflint's exit 2 after a successful fix as success, accepts all extensions tflint supports, and excludes .terraform.

zizmor embedded tests pass with hash pinning (@nettlesh) #1366. Projects using Builtins.hk_test with Builtins.zizmor no longer see five fixture failures on zizmor 1.20+, which requires hash-pinned first-party actions.

Fail-fast status reporting (#1253). Steps are marked aborted before the run is cancelled, and structured output reports cancelled before failed when both apply.

Documentation

Rewritten guides and a redesigned documentation site with a new landing page, reorganized navigation, a CI guide, downloadable example configurations, and richer generated CLI reference pages (@jdx) #1340.

Documented {% raw %}...{% endraw %} for step commands whose tool syntax uses {{, such as kubeconform's -schema-location (@sassdavid) #1359.

New Contributors

@sassdavid made their first contribution in #1362

@nettlesh made their first contribution in #1366

Full Changelog: v1.58.1...v2.0.0

💚 Sponsor hk

hk is built and maintained by @jdx, an open source developer at entire.io, the title sponsor of his open source work.

If hk speeds up your pre-commit loop or makes linting less painful, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep hk fast, free, and independent.

Original source

Important

The original v1.58.0 publishing workflow failed after the tag was created. This backfilled release contains no binary assets and was not published to crates.io. The changes below first became available to installers in v1.58.1; use that version or newer.

This release adds the droast Dockerfile linter and fixes several places where hk's effective behavior diverged from its configuration: project and global Pkl scalar settings now reach the runtime, standalone subdirectory configs stay scoped to their own project, and HK_CHECK plus the corresponding git settings correctly select check or fix commands. Release binaries also regain their embedded Pkl package instead of silently falling back to the network.

Added

• droast Dockerfile linter (@illesnagy1) #1302. The new droast builtin checks Dockerfile, Dockerfile., and Containerfile files and can apply droast's safe, deterministic fixes with hk fix.

Fixed

• Pkl scalar settings now take effect (@jdx) #1307. terminal_progress, walk_ignore, and stash_backup_count are now loaded from project Pkl and user-global configuration, merged with the existing project-first precedence, and shown correctly by hk config dump.
• Standalone subprojects stay in scope (@thespags) #1290. Running hk from a subdirectory with its own hk.pkl no longer causes that config to match unrelated files from the repository root. Literal dir = "." steps are scoped correctly as well.
• Check/fix settings select the right command (@jdx) #1318. HK_CHECK, git config hk.check, and git config hk.fix now affect run-type selection as documented. Explicit flags retain highest precedence, and check mode wins when configuration is contradictory so hk leaves files unchanged.
• pinact sees root action metadata (@risu729) #1321. The pinact and pinact_update builtins now include a repository-root action.yml or action.yaml, not only workflow and nested action files.
• Release binaries embed the Pkl package again (@sahidvelji) #1299. Release builds now generate the gitignored builtin package before compilation and fail if it is absent, preventing a supposedly self-contained binary from silently requiring a network fetch.
• Release publication targets the source repository (@jdx) #1292, avoiding accidental reliance on the caller's current repository context.

Documentation

Corrected configuration precedence, check/fix environment-variable behavior, supported skip reasons, stash descriptions, and several CLI examples; added missing help for hook subcommands and options #1316.

Clarified that Lefthook provides partial pre-commit stash handling while leaving untracked files visible #1297.

Added Open Graph and search metadata, including the initial social preview image #1324 #1327.

Release and CI

Release and performance infrastructure was updated throughout this cycle: hk adopted the mr-boxington cargo shim and dedicated performance runners, restored and refined remote build caching, updated runner images and action dependencies, added conventional-commit enforcement, and introduced signed packslip generation for release artifacts.

New Contributors

@thespags made their first contribution in #1290.

@illesnagy1 made their first contribution in #1302.

Full Changelog: v1.57.0...v1.58.0

💚 Sponsor hk

hk is maintained by @jdx, an open source developer at entire.io, the title sponsor of his open source work.

If hk speeds up your pre-commit loop or makes linting less painful, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep hk fast, free, and independent.

Original source

A small documentation-only release. There are no changes to hk's runtime behavior.

Changed

Page-specific social preview images (@jdx) #1333. Shared documentation links now render a per-page 1200×630 preview card built from the page's title alongside hk's branding, instead of a single site-wide image. Open Graph and Twitter metadata reference the same generated PNG with descriptive alt text, and content-based URLs refresh when the title or artwork changes. Cards are rendered at build time using resvg and a bundled Space Grotesk font, with long titles and CLI command names handled without overlapping the logo.

Full Changelog: v1.58.0...v1.58.1

💚 Sponsor hk

hk is built and maintained by @jdx, an open source developer at entire.io, the title sponsor of his open source work.

If hk speeds up your pre-commit loop or makes linting less painful, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep hk fast, free, and independent.

Original source

This release seeds hk with an embedded Pkl package so matching-version configs validate offline on a cold cache, adds templated dir support for workspace-aware steps, and lands a new check_after_diff mechanism that lets partial fixers (like ShellCheck) apply what they can while still reporting what they cannot. It also brings several new Go and lint builtins plus a batch of correctness fixes for Go linters, gitleaks, workspace paths, Windows shims, and stashing.

Added

Embedded matching-version Pkl package (@sahidvelji) #1218. hk now ships the Pkl package built for its own version and seeds HK_PKL_CACHE_DIR with it before evaluating hk.pkl, so a config pinned to that version validates with no network round trip on a cold cache — a fresh clone, CI runner, new container, or upgrade. Cached content always wins over the embedded copy, and other versions are fetched as before. Set HK_PKL_EMBEDDED=0 to disable seeding. Addresses discussion #1216.

Templated dir through Tera (@sahidvelji) #1219. A step's dir is now rendered through Tera, so a workspace-aware step can point its working directory at the workspace it was matched for instead of prefixing every command with cd {{workspace}} && .... The eight workspace-aware builtins (the Go ones plus cargo_deny) drop their cd prefix as a result. Literal dir values are unaffected.

["go-vet"] {
glob = "**/*.go"
workspace_indicator = "go.mod"
dir = "{{workspace}}"
check = "go vet ./..."
}

check_after_diff for partial fixers (@jdx) #1243. New opt-in step setting that reruns check on the original file batch after a check_diff patch applies, so non-fixable findings stay visible instead of being masked by a clean apply. Requires both check and check_diff to be defined. This underpins ShellCheck's new fixer and other partial fixers.

ShellCheck autofix via check_diff (@sahidvelji) #1237. shellcheck now applies the fixes it can via --format=diff, and thanks to check_after_diff a file with both fixable and non-fixable findings is fixed and still fails on what remains. Implements proposal 2 of #1234.

go_fix builtin (@sahidvelji) #1224. Wraps Go's go fix (the Go 1.26+ analyzer-driven modernizer) — interface{} → any, sort.Slice → slices.Sort, wg.Add/go/wg.Done → wg.Go, and more. check_diff runs go fix -diff ./... and hk applies the patch directly. Requires Go 1.26+.

golangci_lint_fmt formatter builtin (@sahidvelji) #1244. Wraps golangci-lint fmt, the formatter half of golangci-lint, formatting only the changed files via check_diff (using fmt --diff) — separate from the existing golangci_lint builtin that runs the full linter.

ls_lint builtin (@sahidvelji) #1238. Adds a builtin for ls-lint, which enforces directory and filename naming conventions against .ls-lint.yml. Runs once per invocation. Implements proposal 3 of #1234.

gitleaks_staged builtin (@jdx) #1248. A new builtin that runs gitleaks git --pre-commit --staged to scan only the staged index, suited to pre-commit hooks.

Per-step allow_failure (@jdx) #1291. Steps can report a non-zero command exit without failing the overall hook, including conditional policies via expressions such as env('KNOWN_BROKEN') == 'true'. hk's own execution and configuration errors remain blocking, and allowed failures are surfaced in structured output.

Fixed

Go linters that reported success on bad code (@sahidvelji) #1225. go_imports, go_lines, revive, and go_fumpt silently passed in check mode even with real findings; they now take their exit code correctly. gomod_tidy could not run outside the repo root and is now scoped like the other Go builtins.

gitleaks scan modes (@jdx) #1248. Builtins.gitleaks now explicitly scans the repository working tree rather than silently changing behavior when {{files}} expanded to multiple paths.

gomod_tidy now runs on .go changes (@sahidvelji) #1236. Broadened the glob to **/*.go, **/go.mod, and **/go.sum so the common drift (editing an import) is caught at commit time, and its go.mod/go.sum updates are now staged when triggered by a Go change (@jdx) #1240.

Partial diff fixes no longer pass silently (@jdx) #1245. Enabled check_after_diff for rumdl, ryl, ryl_markdown, zizmor, and pinact_v3, so remaining violations surface after hk applies each partial patch.

Workspace paths in literal dir steps (@jdx) #1242. {{workspace}} and {{workspace_indicator}} are now rendered relative to a literal step directory, preventing duplicated paths like ui/ui/tsconfig.json in subprojects. Addresses discussion #1233.

Windows command shims (@jdx) #1221. Structured argv steps now resolve .cmd/.bat targets (including npm node_modules/.bin shims) via the effective PATH/PATHEXT and run them through cmd.exe with argument-boundary-preserving escaping. Fixes discussion #1220.

Empty pathspec stashes (@jdx) #1283. Pre-commit runs no longer reset the index and leave an orphaned stash when a path-limited stash has no HEAD-to-worktree diff (e.g. mode-only staged changes). Addresses discussion #1281.

New Contributors

@sahidvelji made their first contribution in #1218

Full Changelog: v1.56.1...v1.57.0

💚 Sponsor hk

hk is maintained by @jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools including mise, aube, and more. Work on hk is funded by sponsorships.

If hk has sped up your pre-commit loop or made linting feel less painful, please consider sponsoring at jdx.dev. Sponsorships are what keep hk moving and the project independent.

AI-assisted — Tool: Codex; model: openai/gpt-5; version: unavailable.

Original source