diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 3be49ca..c382f98 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -2,13 +2,14 @@ name: Release on: push: tags: ["v*"] -permissions: - contents: write +permissions: {} concurrency: group: release cancel-in-progress: false jobs: build: + permissions: + contents: read runs-on: ubuntu-26.04 timeout-minutes: 20 strategy: @@ -36,6 +37,8 @@ jobs: uses: jdx/mise-action@6612f0ef07ed2a736cd1e00a94a065522dd41195 # v5.2.5 with: version: 2026.10.25 + # A cache from a pull request could reach the published artifacts. + cache: false - name: Build env: GOOS: ${{ matrix.platform.os }} @@ -52,6 +55,8 @@ jobs: if-no-files-found: error publish: needs: build + permissions: + contents: write runs-on: ubuntu-26.04 timeout-minutes: 10 env: diff --git a/hk.pkl b/hk.pkl index f9c4c02..bd3cd35 100644 --- a/hk.pkl +++ b/hk.pkl @@ -1,64 +1,49 @@ +// hk's own builtins, the extra builtins, and the hook templates from +// nnutter/hk-config. The hk-config version must target the hk pin in +// mise.toml, and the revision is the newest one released for that hk version. amends - "package://github.com/nnutter/hk-config/releases/download/v2.11.1-0/hk-config@2.11.1-0#/Config.pkl" + "package://github.com/nnutter/hk-config/releases/download/v2.11.1-2/hk-config@2.11.1-2#/Config.pkl" -import "package://github.com/jdx/hk/releases/download/v2.11.1/hk@2.11.1#/Builtins.pkl" as Hk import - "package://github.com/nnutter/hk-config/releases/download/v2.11.1-0/hk-config@2.11.1-0#/Builtins.pkl" + "package://github.com/nnutter/hk-config/releases/download/v2.11.1-2/hk-config@2.11.1-2#/Builtins.pkl" as Extra +import + "package://github.com/nnutter/hk-config/releases/download/v2.11.1-2/hk-config@2.11.1-2#/Hooks.pkl" + as Hooks /// Test fixtures hold deliberately invalid input for the tests that read them. exclude = List("**/testdata/**") -steps { - // Use a custom constable step in order to use the development version of constable. - ["constable"] { - check = "go run ./cmd/constable ./..." - } - ["errcheck"] = Hk.err_check - ["gitleaks"] = Hk.gitleaks - ["go_check_sumtype"] = Extra.go_check_sumtype - ["go_fix"] = Hk.go_fix - ["go_fumpt"] = Hk.go_fumpt - ["go_imports"] = Extra.go_imports - ["go_sec"] = Extra.go_sec - ["go_vet"] = Hk.go_vet - ["go_vuln_check"] = Hk.go_vuln_check - ["gomod_tidy"] = Hk.gomod_tidy - ["mdlint"] = Extra.mdlint - ["newlines"] = Hk.newlines - ["nilaway"] = Extra.nilaway - ["pkl"] = Hk.pkl - ["pkl_format"] = Hk.pkl_format - ["skills_ref"] = Extra.skills_ref - ["staticcheck"] = Hk.staticcheck - ["testifylint"] = Extra.testifylint - ["tombi"] = Hk.tombi - ["tombi_format"] = Hk.tombi_format - ["trailing_whitespace"] = Hk.trailing_whitespace - ["yamlfmt"] = Hk.yamlfmt +// This repository develops constable, so every hook runs the working tree's +// build instead of the installed release. +local const constableDev = (Extra.constable) { + check = "go run ./cmd/constable ./..." + fix = "go run ./cmd/constable -fix ./..." } -hooks { - ["commit-msg"] { - fix = true +// The templates build the check, fix, pre-commit, and commit-msg hooks, and +// they order the steps of each hook that fixes: the steps that rewrite files +// run in the order their edits must land, and every step that only reads waits +// for the last fixer, so the readers run together. `check` sets no order. +// `go`, `toml`, `yaml`, and `agentskills` are the groups this repository needs. +// +// A replaced step is a new step, so the template's order does not reach it: the +// go group runs constable after testifylint, and the replacement keeps that +// place in the hooks that fix. +hooks = (Hooks.all(List("go", "toml", "yaml", "agentskills"))) { + ["check"] { + steps { + ["constable"] = constableDev + } + } + ["fix"] { steps { - ["change-id"] = Extra.timber_commit_msg + ["constable"] = (constableDev) { depends = List("testifylint") } } } ["pre-commit"] { - fix = true - stage = true - stash = "git" steps { - // No file filter: scan every staged change, including arbitrary types, - // binary files, deletions, and commits without Go or Markdown changes. - // The git-mode scan only sees text diffs, so staged binary bytes are - // checked out to a temporary directory and scanned explicitly. - ["gitleaks"] = (Hk.gitleaks) { - scan = "staged" - check = - "gitleaks git --redact --pre-commit --staged --verbose --no-banner && tmp=$(mktemp -d) || exit $?; trap 'rm -rf \"$tmp\"' EXIT INT TERM; git diff --cached --name-only -z --diff-filter=ACMRT > \"$tmp/list\" || exit $?; git checkout-index -z --stdin --prefix=\"$tmp/tree/\" < \"$tmp/list\" || exit $?; mkdir -p \"$tmp/tree\" || exit $?; gitleaks dir --redact --verbose --no-banner \"$tmp/tree\" || exit $?" - } + ["constable"] = (constableDev) { depends = List("testifylint") } } } } diff --git a/mise.lock b/mise.lock index 2b4ceab..d1024fa 100644 --- a/mise.lock +++ b/mise.lock @@ -269,6 +269,11 @@ version = "1.30.0" backend = "go:github.com/kisielk/errcheck" specifiers = ["latest"] +[[tools."go:github.com/kojah/gohawk"]] +version = "0.7.1" +backend = "go:github.com/kojah/gohawk" +specifiers = ["latest"] + [[tools."go:github.com/nnutter/testifylint"]] version = "0.0.0-20261101203540-577bf922d916" backend = "go:github.com/nnutter/testifylint" @@ -377,6 +382,53 @@ url = "https://github.com/jdx/hk/releases/download/v2.11.1/hk-x86_64-pc-windows- signer = "sigstore-oidc:https://github.com/jdx/hk/.github/workflows/release.yml" repository_ids = { repository = "922514152" } +[[tools.jactionlint]] +version = "2.4.0" +backend = "packslip:github.com/jdx/jactionlint" +specifiers = ["latest"] + +[tools.jactionlint."platforms.linux-arm64"] +checksum = "sha256:42413391c248f99ff4550d6c866ee717d5ea4ca2b966d9d54ad1503af955e22f" +url = "https://github.com/jdx/jactionlint/releases/download/v2.4.0/jactionlint_2.4.0_linux_arm64.tar.gz" +signer = "sigstore-oidc:https://github.com/jdx/jactionlint/.github/workflows/release.yaml" +repository_ids = { repository = "1404951382" } + +[tools.jactionlint."platforms.linux-arm64-musl"] +checksum = "sha256:42413391c248f99ff4550d6c866ee717d5ea4ca2b966d9d54ad1503af955e22f" +url = "https://github.com/jdx/jactionlint/releases/download/v2.4.0/jactionlint_2.4.0_linux_arm64.tar.gz" +signer = "sigstore-oidc:https://github.com/jdx/jactionlint/.github/workflows/release.yaml" +repository_ids = { repository = "1404951382" } + +[tools.jactionlint."platforms.linux-x64"] +checksum = "sha256:26ddba81db28fffc51163175c070ee1a9d1150260de4b5232f01d9b749f32d8e" +url = "https://github.com/jdx/jactionlint/releases/download/v2.4.0/jactionlint_2.4.0_linux_amd64.tar.gz" +signer = "sigstore-oidc:https://github.com/jdx/jactionlint/.github/workflows/release.yaml" +repository_ids = { repository = "1404951382" } + +[tools.jactionlint."platforms.linux-x64-musl"] +checksum = "sha256:26ddba81db28fffc51163175c070ee1a9d1150260de4b5232f01d9b749f32d8e" +url = "https://github.com/jdx/jactionlint/releases/download/v2.4.0/jactionlint_2.4.0_linux_amd64.tar.gz" +signer = "sigstore-oidc:https://github.com/jdx/jactionlint/.github/workflows/release.yaml" +repository_ids = { repository = "1404951382" } + +[tools.jactionlint."platforms.macos-arm64"] +checksum = "sha256:349a13dbffdd25376898a256d195806afda08ba97ccc6378cbf2dd11a77ef8e7" +url = "https://github.com/jdx/jactionlint/releases/download/v2.4.0/jactionlint_2.4.0_darwin_arm64.tar.gz" +signer = "sigstore-oidc:https://github.com/jdx/jactionlint/.github/workflows/release.yaml" +repository_ids = { repository = "1404951382" } + +[tools.jactionlint."platforms.macos-x64"] +checksum = "sha256:4c21fce834f8267b65a65b32a527aaa2ec1c321c8f066d44b42d7f038835aa90" +url = "https://github.com/jdx/jactionlint/releases/download/v2.4.0/jactionlint_2.4.0_darwin_amd64.tar.gz" +signer = "sigstore-oidc:https://github.com/jdx/jactionlint/.github/workflows/release.yaml" +repository_ids = { repository = "1404951382" } + +[tools.jactionlint."platforms.windows-x64"] +checksum = "sha256:4e0c7b428a4faa35bb3b86af6fa65a0ac9797edcd4c64e4f7e16ca886437e172" +url = "https://github.com/jdx/jactionlint/releases/download/v2.4.0/jactionlint_2.4.0_windows_amd64.zip" +signer = "sigstore-oidc:https://github.com/jdx/jactionlint/.github/workflows/release.yaml" +repository_ids = { repository = "1404951382" } + [[tools.pkl]] version = "0.32.2" backend = "aqua:apple/pkl" diff --git a/mise.toml b/mise.toml index 480006f..417f91d 100644 --- a/mise.toml +++ b/mise.toml @@ -2,6 +2,7 @@ minimum_release_age = "0" [tools] +jactionlint = "latest" "github:alecthomas/go-check-sumtype" = "latest" "github:nnutter/mdlint" = "latest" "github:nnutter/timber" = "latest" @@ -9,6 +10,7 @@ minimum_release_age = "0" gitleaks = "latest" go = "latest" "go:github.com/kisielk/errcheck" = "latest" +"go:github.com/kojah/gohawk" = "latest" "go:github.com/nnutter/testifylint" = "latest" "go:go.uber.org/nilaway/cmd/nilaway" = "latest" "go:golang.org/x/tools/cmd/goimports" = "latest" @@ -65,8 +67,4 @@ run = [{ task = "all" }] [tasks.on-stop] description = "Fix edited files, then test and check" usage = 'arg "[staged_files]" var=#true' -run = [ - "mise run fix ${usage_staged_files}", - "mise run test", - "mise run check", -] +run = ["mise run fix ${usage_staged_files}", "mise run test", "mise run check"]