hk.pkl

amends "package://github.com/jdx/hk/releases/download/v1.53.0/hk@1.53.0#/Config.pkl"

import "package://github.com/jdx/hk/releases/download/v1.53.0/hk@1.53.0#/Builtins.pkl"

local bash: String = "bash -c"

// No `shell` override: these builtins are `hk util` subcommands, so they need
// no shell, and the structured form is what lets hk auto-batch `{{files}}`.
// Under a shell hk sizes batches from ARG_MAX (128KB fallback on Windows), so
// a whole-repo run renders one ~15KB command that Windows rejects with "The
// command line is too long."
local sharedGuards = new Mapping<String, Step> {
    ["check-merge-conflict"] = (Builtins.check_merge_conflict) {}
    ["detect-private-key"] = (Builtins.detect_private_key) {}
    ["check-added-large-files"] = (Builtins.check_added_large_files) {
        exclude = List(
            "pnpm-lock.yaml",
            "src/typegen.d.ts",
            "src/oxlint/typegen.d.ts",
            "test/__snapshots__/eslint-snapshot.spec.ts.snap",
            "test/__snapshots__/oxlint.spec.ts.snap",
        )
    }
}

// `isentinel-lint` shims to `dist/lint-cli.mjs`, so the bin does not exist
// until something builds it — a fresh clone would otherwise fail the lint step.
// Skips `nr gen`: the typegen files it writes are tracked, so they are already
// present, and regenerating them here would rewrite tracked files mid-commit.
// `tsdown.config.ts` sets `clean: true`, so `dist` is emptied at build start
// and is briefly absent — the lint step's `depends` is what keeps that window
// from being observable, not the omitted `--clean` flag.
local build = new Step {
    check = "pnpm exec tsdown"
    shell = bash
}

// The hybrid CLI sequences oxlint then ESLint itself, dropping the
// oxlint-covered rules from the ESLint pass, so a separate oxlint step would
// only double-lint. GIT_HOOK pins hook runs to the no-agent cache variant.
// `depends` is load-bearing: hk runs steps concurrently by default, so without
// it the build could still be writing `dist` as this step loads it.
local lint = new Step {
    glob = List("*.ts", "*.tsx", "*.js", "*.mjs", "*.cjs", "*.json", "*.jsonc", "*.md", "*.toml", "*.yaml", "*.yml")
    depends = List("build")
    check = "isentinel-lint {{files}}"
    fix = "isentinel-lint --fix {{files}}"
    shell = bash
    env = new Mapping<String, String> { ["GIT_HOOK"] = "1" }
}

local typecheck = new Step {
    glob = List("*.ts", "*.tsx")
    check = "tsc --noEmit"
    shell = bash
}

// Runs `vitest` directly rather than the `test` script, which prefixes `nr
// gen` and would rewrite tracked typegen files mid-commit.
local test = new Step {
    glob = List("*.ts", "*.tsx")
    check = "pnpm exec vitest run"
    shell = bash
}

local renovateConfig = new Step {
    glob = List("renovate.json")
    check = "pnpm dlx --package renovate renovate-config-validator --strict"
    shell = bash
}

hooks {
    ["pre-commit"] {
        fix = true
        stash = "none"
        steps {
            ...sharedGuards
            ["renovate-config"] = renovateConfig
            ["build"] = build
            ["lint"] = lint
            ["typecheck"] = typecheck
            ["test"] = test
        }
    }
    ["pre-push"] {
        steps {
            ...sharedGuards
            ["build"] = build
            ["lint"] = lint
            ["typecheck"] = typecheck
        }
    }
    ["post-merge"] {
        steps {
            ["install-deps"] {
                glob = List("pnpm-lock.yaml")
                check = "pnpm install"
                shell = bash
            }
            ["mise-install"] {
                glob = List("mise.toml")
                check = "mise install"
                shell = bash
            }
        }
    }
    ["check"] {
        steps {
            ...sharedGuards
            ["renovate-config"] = renovateConfig
            ["build"] = build
            ["lint"] = lint
            ["typecheck"] = typecheck
        }
    }
}