v2.8.0: YAML formatting with ryl and a builtin for global mise config repositories

hk 2.8.0 adds builtins that format YAML with ryl format and a builtin for repositories that hold a global mise config. It also stops commit signing from breaking hk test, and updates the bundled TLS certificate crates after the eMudhra CA compromise.

Added

• ryl_format and ryl_markdown_format builtins (#1737, @jdx). Builtins.ryl_format formats YAML files. Builtins.ryl_markdown_format formats YAML front matter and fenced yaml/yml blocks in Markdown files. check runs ryl format --check, check_diff runs ryl format --diff, and fix runs ryl format. Set formatting options in the [format] table of .ryl.toml. These builtins need ryl 0.25 or later. The existing ryl and ryl_markdown linters work as before.

  ["ryl_format"] = Builtins.ryl_format
  ["ryl_markdown_format"] = Builtins.ryl_markdown_format

• mise_config_dir builtin (#1733, @jdx). This opt-in builtin formats a repository checked out at ~/.config/mise, for example one set up with mise bootstrap --adopt. It matches config.toml, config.*.toml, conf.d/*.toml, conf.d/*/mise.toml and conf.d/*/mise.*.toml. Each file goes through mise fmt --stdin, so files outside the repository are never touched. Builtins.mise is unchanged, which means repositories that use config.toml for other tools aren't affected. fix uses sh, so on Windows it needs a POSIX shell.

  hooks { ["check"] { steps { ["mise"] = Builtins.mise_config_dir } } }

Fixed

• hk test passes when commit signing is turned on (#1735, @jdx). The tests for the no_commit_to_branch and destroyed_symlinks builtins create commits in a scratch repository. If your git config set commit.gpgsign without a signing key that applies to that repository, those commits failed and so did the tests. The test commits now turn signing off.

Security

• Compromised eMudhra intermediate CAs are no longer trusted (#1742, @jdx). rustls-webpki is updated to 0.103.16 and webpki-root-certs to 1.0.10. hk ships its own list of trusted root certificates, and the updated list stops trusting eight eMudhra intermediate certificates whose private keys were compromised.

Full Changelog: v2.7.1...v2.8.0

💚 Sponsor hk

hk is built and maintained by @jdx, an open source developer at entire.io, the title sponsor of his open source work.

If hk speeds up your pre-commit loop or makes linting less painful, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep hk fast, free, and independent.