Distribute hk tasks via gtb hk + mise.tasks.toml, add hk preset

[gtbuchanan]

Summary

Distributes the hk pre-commit setup as reusable, sync-owned config instead of bash scripts, and factors the shared hk steps into a Pkl preset.

• gtb hk (all / base) — ports the mise-tasks/hk/* bash into a testable TS leaf command (CI check vs local fix, shallow-clone base fetch, HK_BATCH batching for the Windows cmd.exe arg limit). Spawning hk from Node removes the Git Bash run_native/cygpath PATH dance and the IFS file-splitting entirely.
• mise.tasks.toml — generated by gtb sync, wiring hk:all / hk:base to gtb hk. Loaded via a one-time manual [task_config] includes line that gtb verify asserts (so sync never round-trips the comment-heavy mise.toml). The task resolves gtb per repo shape: self-hosted → pnpm run gtb; depends on @gtbuchanan/cli → pnpm exec gtb; hk-only adopter → bare gtb from mise's npm: backend (no node_modules needed).
• Scoped gtb sync / gtb verify — positional scope args (codecov, mise, scripts, tsconfig, turbo), e.g. gtb sync mise / gtb verify mise, so the hk tasks can be (re)generated/checked standalone without a full workspace sync. No args = all. Shared parser in lib/sync-scopes.ts.
• hk/Defaults.pkl — shared hk preset (fileHygiene, forbidSubmodules, renovateConfig, lockfiles/batchFiles). hk.pkl imports it by relative path (self-host can't package://-import its own unpublished release — same trap as the ./ workflow refs). The Renovate customManager now covers all .pkl URLs.

Validation

246 unit tests, typecheck, lint, full @gtbuchanan/cli build + e2e, pkl eval on both Pkl files, and the live mise run hk:base → gtb hk → hk chain (plus the refactored preset running in this PR's own pre-commit hooks). gtb verify clean.

Follow-up

Pkl publishing is deferred — Defaults.pkl is self-host-only; consumer package:// distribution (PklProject + cd.yml publish + Renovate manager for the gtbuchanan URL) is a separate PR.

🤖 Generated with Claude Code

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 6200832f-6c45-4f1c-b1f6-a45451c351dc

📥 Commits

Reviewing files that changed from the base of the PR and between 2027c7d and b000715.

⛔ Files ignored due to path filters (3)

• hk.pkl is excluded by !**/*.pkl
• hk/Defaults.pkl is excluded by !**/*.pkl
• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (27)

• AGENTS.md
• README.md
• default.json
• mise-tasks/hk/all
• mise-tasks/hk/base
• mise-tasks/lib.sh
• mise.tasks.toml
• mise.toml
• packages/cli/package.json
• packages/cli/skills/gtb-build-pipeline/SKILL.md
• packages/cli/src/commands/index.ts
• packages/cli/src/commands/root/hk.ts
• packages/cli/src/commands/root/names.ts
• packages/cli/src/commands/root/sync.ts
• packages/cli/src/commands/root/verify.ts
• packages/cli/src/lib/discovery.ts
• packages/cli/src/lib/mise-tasks.ts
• packages/cli/src/lib/process.ts
• packages/cli/src/lib/sync-scopes.ts
• packages/cli/test/hk.test.ts
• packages/cli/test/mise-tasks.test.ts
• packages/cli/test/process.test.ts
• packages/cli/test/sync-scopes.test.ts
• packages/cli/test/sync.test.ts
• packages/cli/test/turbo-config.helpers.ts
• packages/cli/test/verify.test.ts
• pnpm-workspace.yaml

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• gtbuchanan/tooling (manual)

💤 Files with no reviewable changes (3)

• mise-tasks/hk/all
• mise-tasks/lib.sh
• mise-tasks/hk/base

📜 Recent review details

🧰 Additional context used

📓 Path-based instructions (3)

default.json

📄 CodeRabbit inference engine (AGENTS.md)

default.json: A Renovate customManager in default.json keeps the hk version in all .pkl package URLs (hk.pkl, hk/Defaults.pkl) in lockstep.
Renovate preset should use timezone: "America/Chicago" to anchor the weekly lockFileMaintenance schedule.
Renovate preset should set labels: ["dependencies"] to tag every Renovate PR for filtering.
Renovate preset should set minimumReleaseAge: "3 days" for supply-chain quarantine on new releases.
Renovate preset should set osvVulnerabilityAlerts: true to opt into OSV-based alerts, separate from GitHub's GHSA feed.
Renovate preset should set platformCommit: "enabled" to force commits via GitHub App API so the bot's commits show the verified checkmark.
Renovate preset should set postUpdateOptions: ["pnpmDedupe"] to run pnpm dedupe after each update to keep the lockfile lean.
Renovate preset should set pre-commit.enabled: true because Renovate's pre-commit manager is off by default; enable so .pre-commit-config.yaml hooks get bumped.
Renovate preset should set rebaseWhen: "conflicted" to reduce no-op CI runs at the cost of staler PRs (default "auto" rebases on every base-branch move).
Renovate preset should set semanticCommits: "disabled" to match the repo's sentence-case commit style instead of semantic prefixes.
Use packageRules in Renovate preset to throttle fast-moving deps (renovatebot/pre-commit-hooks, renovate CLI) at bi-monthly schedule (1,15) to avoid multiple bump PRs per week.

Files:

• default.json

README.md

📄 CodeRabbit inference engine (AGENTS.md)

When adding or removing a package, update the packages table in README.md and the structure tree.

Files:

• README.md

**/*.test.{js,ts}

📄 CodeRabbit inference engine (AGENTS.md)

**/*.test.{js,ts}: Use expect(result).toMatchObject({ exitCode: 0 }) instead of expect(result.exitCode).toBe(0) when asserting on CommandResult (exit code, stdout, stderr). On failure, toMatchObject shows the full result object (including stderr) in the diff, making failures self-diagnosing.
Generate incidental test data via @gtbuchanan/test-utils/builders (or @faker-js/faker directly for one-off primitives) and capture the result in a local so the assertion references the captured value, not a duplicate literal. Convention: import * as build from '@gtbuchanan/test-utils/builders', then const name = build.scopedPackageName() and expect(result).toHaveProperty('name', name). Only hard-code literals when the SUT branches on the specific string.
Slow tests use Vitest's native tag system (test('name', { tags: ['slow'] }, ...) or /** @module-tag slow */). The --tags-filter CLI option controls which tests run (!slow for fast, slow for slow-only, omit for all).

Files:

• packages/cli/test/verify.test.ts
• packages/cli/test/mise-tasks.test.ts
• packages/cli/test/sync.test.ts
• packages/cli/test/sync-scopes.test.ts
• packages/cli/test/hk.test.ts
• packages/cli/test/process.test.ts

🧠 Learnings (2)

📓 Common learnings

Learnt from: CR
Repo: gtbuchanan/tooling

Timestamp: 2026-06-10T22:09:58.019Z
Learning: Consumer directory convention: `test/` for source tests (unit + integration) with coverage via source config, and `e2e/` for artifact tests with no source coverage that need tarballs from pack.

Learnt from: CR
Repo: gtbuchanan/tooling

Timestamp: 2026-06-10T22:09:58.019Z
Learning: Branch protection keys should be on the leaf job name (e.g. 'Build', 'E2E Test', 'Pre-Commit Run', 'Dependency Review'), not the workflow or the calling job, so leaf names must stay descriptive and unique.

Learnt from: CR
Repo: gtbuchanan/tooling

Timestamp: 2026-06-10T22:09:58.019Z
Learning: Every PR requires a changeset. Create a `.changeset/<name>.md` file with YAML frontmatter listing affected packages and bump types.

Learnt from: CR
Repo: gtbuchanan/tooling

Timestamp: 2026-06-10T22:09:58.019Z
Learning: For PRs that don't affect published packages, create an empty changeset (no packages in frontmatter).

Learnt from: CR
Repo: gtbuchanan/tooling

Timestamp: 2026-06-10T22:09:58.019Z
Learning: Run `pnpm build`, `pnpm test:slow`, and `pnpm test:e2e` with `--concurrency=1` on Termux to avoid OOM.

Learnt from: CR
Repo: gtbuchanan/tooling

Timestamp: 2026-06-10T22:09:58.019Z
Learning: Turbo configuration should account for workspace cache invalidation: source changes in any `packages/*` workspace fully invalidate every task's cache across all packages because internal dependencies are mixed into the hash.

📚 Learning: 2026-06-04T02:26:02.824Z

Learnt from: gtbuchanan
Repo: gtbuchanan/tooling PR: 139
File: packages/cli/test/coverage-codecov-upload.test.ts:2-2
Timestamp: 2026-06-04T02:26:02.824Z
Learning: In tests within **/{test,e2e,__tests__}/**/*.{test,spec}.{ts,tsx,js,jsx}, follow the AGENTS.md faker convention: direct `faker-js/faker` usage is allowed only for one-off primitives when the produced value’s shape is exactly what faker returns (e.g., `faker.git.commitSha()`, `faker.string.uuid()`). Use `gtbuchanan/test-utils/builders` only when there is a domain-shaped value worth centralizing (e.g., scoped package names, semver ranges, GitHub URLs). Do not wrap a native faker generator in a builder for a plain primitive (e.g., a raw commit SHA), since that adds indirection without centralizing any domain shape.

Applied to files:

• packages/cli/test/verify.test.ts
• packages/cli/test/mise-tasks.test.ts
• packages/cli/test/sync.test.ts
• packages/cli/test/sync-scopes.test.ts
• packages/cli/test/hk.test.ts
• packages/cli/test/process.test.ts

🪛 LanguageTool

AGENTS.md

[grammar] ~107-~107: Ensure spelling is correct
Context: ...-illegal-windows-names` was dropped (no builtin; redundant on a Windows-primary repo...

(QB_NEW_EN_ORTHOGRAPHY_ERROR_IDS_1)

🔇 Additional comments (28)

packages/cli/src/lib/sync-scopes.ts (1)

6-36: LGTM!

packages/cli/src/lib/discovery.ts (1)

47-48: LGTM!

Also applies to: 147-147

packages/cli/test/hk.test.ts (1)

1-168: LGTM!

packages/cli/test/mise-tasks.test.ts (1)

1-78: LGTM!

packages/cli/test/process.test.ts (1)

1-25: LGTM!

packages/cli/test/sync-scopes.test.ts (1)

1-21: LGTM!

packages/cli/test/sync.test.ts (1)

234-257: LGTM!

Also applies to: 306-321

packages/cli/test/turbo-config.helpers.ts (1)

33-34: LGTM!

Also applies to: 45-50

packages/cli/test/verify.test.ts (1)

225-272: LGTM!

Also applies to: 306-314

mise.tasks.toml (1)

1-11: LGTM!

mise.toml (1)

23-26: LGTM!

default.json (1)

8-11: LGTM!

pnpm-workspace.yaml (1)

47-47: LGTM!

packages/cli/package.json (1)

33-33: LGTM!

AGENTS.md (3)

11-16: LGTM!

---

97-119: LGTM!

---

121-147: LGTM!

README.md (1)

234-237: LGTM!

packages/cli/skills/gtb-build-pipeline/SKILL.md (3)

3-3: LGTM!

---

77-89: LGTM!

---

91-98: LGTM!

packages/cli/src/lib/mise-tasks.ts (1)

1-94: LGTM!

packages/cli/src/commands/root/sync.ts (1)

66-79: LGTM!

Also applies to: 90-111, 130-150, 166-184, 186-214

packages/cli/src/commands/root/verify.ts (1)

10-13: LGTM!

Also applies to: 242-282, 284-328, 330-357

packages/cli/src/lib/process.ts (1)

32-53: LGTM!

packages/cli/src/commands/root/hk.ts (1)

1-152: LGTM!

packages/cli/src/commands/index.ts (1)

2-2: LGTM!

Also applies to: 18-18

packages/cli/src/commands/root/names.ts (1)

3-3: LGTM!

---

📝 Walkthrough

Walkthrough

This PR replaces bash-based mise-tasks/hk/* scripts with a new gtb hk CLI command, introduces scope-aware gtb sync and gtb verify to selectively generate/validate artifacts, generates mise.tasks.toml for task discovery, and adds smol-toml dependency for TOML parsing.

Changes

HK command and scope-aware configuration generation

Layer / File(s)	Summary
Scope definitions and workspace discovery packages/cli/src/lib/sync-scopes.ts, packages/cli/src/lib/discovery.ts	Introduces configurable sync scopes (codecov, mise, scripts, tsconfig, turbo) with parsing logic. WorkspaceDiscovery gains dependsOnCli field detecting root @gtbuchanan/cli dependency.
HK command implementation and execution packages/cli/src/commands/root/hk.ts	New gtb hk command with all and base subcommands. Plans and executes hk against full repo or changed files, detects shallow clones, handles base ref fetching, enforces HK_BATCH=1 for full runs, and supports dependency injection for testing.
Mise tasks generation and include validation packages/cli/src/lib/mise-tasks.ts	Generates mise.tasks.toml with hk:all and hk:base task definitions based on workspace discovery. Validates mise.toml includes generated tasks file, reporting drift when missing.
Process spawning helper for command capture packages/cli/src/lib/process.ts	Adds capture(command, args) to spawn processes with piped stdout, trimming output and rejecting on non-zero exit codes.
Scope-aware sync command refactoring packages/cli/src/commands/root/sync.ts	runSync accepts optional scopes set and conditionally generates artifacts via dispatch map. syncCommand parses positional scope tokens, logs errors, returns exit codes. CLI wrapper passes scopes and manages exit code.
Scope-aware verify command refactoring packages/cli/src/commands/root/verify.ts	runVerify refactored to scope-gated checks map including new mise validation. verifyCommand parses scopes, logs errors, returns exit codes. Consolidated script checks via checkAllScripts helper.
Command registration and entry point wiring packages/cli/src/commands/index.ts, packages/cli/src/commands/root/names.ts	Imports and registers hk command module at root level via rootNames.hk, enabling gtb hk dispatch.
Generated configuration and manifest updates mise.tasks.toml, mise.toml, default.json, pnpm-workspace.yaml, packages/cli/package.json	Adds mise.tasks.toml with hk tasks, mise.toml includes configuration, broadens Renovate .pkl pattern matching, catalogs smol-toml@1.6.1, and adds CLI dependency.
Documentation and guidance updates AGENTS.md, README.md, packages/cli/skills/gtb-build-pipeline/SKILL.md	Updated to describe mise.tasks.toml generation, hk/Defaults.pkl composition, gtb hk command forms, scope-based sync/verify, and batching behavior. Removed references to legacy mise-tasks/ scripts.
Comprehensive test coverage packages/cli/test/hk.test.ts, packages/cli/test/mise-tasks.test.ts, packages/cli/test/process.test.ts, packages/cli/test/sync-scopes.test.ts, packages/cli/test/sync.test.ts, packages/cli/test/verify.test.ts, packages/cli/test/turbo-config.helpers.ts	Tests verify base ref resolution, hk mode selection, planning/execution (including shallow clones), task generation with different configs, include drift detection, scope parsing, and scope-based artifact/check selection.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Possibly related PRs

• gtbuchanan/tooling#157: Directly replaces the bash mise-tasks/hk/* scripts and run_native helper with the new TypeScript gtb hk command and generated mise.tasks.toml/mise.toml wiring.
• gtbuchanan/tooling#150: Both PRs refactor gtb verify to include codecov drift validation; this PR adds scope-aware verification and new mise.toml include checks while the related PR focuses on codecov config validation.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main changes: distributing hk tasks via gtb hk and mise.tasks.toml, plus adding an hk preset, which aligns with the primary objectives of the PR.
Description check	✅ Passed	The description comprehensively explains the changes, objectives, and validation approach, directly related to the changeset including gtb hk command, mise.tasks.toml generation, scoped sync/verify, and the hk/Defaults.pkl preset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codecov-commenter]

Codecov Report

❌ Patch coverage is 93.65079% with 8 lines in your changes missing coverage. Please review.
✅ Project coverage is 80.42%. Comparing base (2027c7d) to head (b000715).

Files with missing lines	Patch %	Lines
packages/cli/src/commands/root/sync.ts	91.66%	3 Missing ⚠️
packages/cli/src/commands/root/hk.ts	93.10%	2 Missing ⚠️
packages/cli/src/commands/root/verify.ts	88.23%	1 Missing and 1 partial ⚠️
packages/cli/src/lib/mise-tasks.ts	95.23%	0 Missing and 1 partial ⚠️

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.