Use hk to run linters (#3412)

This updates our linting set up to use `hk` as the tool runner for our
various linters. `hk` is a new tool that is designed to run commands as
part of a Git commit, and through that it can be used to run linting
tools. It's a proposed alternative to `pre-commit` with some specific
goals around running linters in parallel and being highly performant.

This is proposed as an alternative to #3001 to avoid the need to add
Python to our project, specifically `hk` is provided as a binary and can
be included in `.tool-versions` installed by Mise. On the other hand,
compared to `pre-commit`, `hk` is a new project and not yet fully
supported (there's a warning that things may change in each release on
the project website), so we may choose to put this off until a time when
`hk` becomes more mature.

This comes with similar advantages to `pre-commit`, such as having a
standard approach to configuring our linting tools, and for those who
wish to, it allows you to integrate the linting with `git commit`.

In this PR, I've converting our existing GitHub Actions workflow to a
single linting workflow which calls `hk check`. This does mean we lose
granularity of individual linters, and if we'd prefer to stick with our
existing approach that can be done by using `hk check --linter
<linter>`.

Author: thomasleese

.github/workflows/lint.yml

@@ -3,9 +3,12 @@ name: Lint
 on:
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
-  prettier:
-    name: Prettier
+  lint:
+    name: Lint
     runs-on: ubuntu-latest
 
     steps:
@@ -15,71 +18,12 @@ jobs:
           bundler-cache: true
       - uses: actions/setup-node@v4
         with:
-          node-version-file: .tool-versions
           cache: yarn
-      - run: yarn install --immutable --immutable-cache --check-cache
-      - run: yarn prettier --check --ignore-unknown '**/*'
-
-  rubocop:
-    name: Rubocop
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v4
-      - uses: ruby/setup-ruby@v1
-        with:
-          bundler-cache: true
-      - uses: actions/setup-node@v4
-        with:
           node-version-file: .tool-versions
-          cache: yarn
       - run: yarn install --immutable --immutable-cache --check-cache
-      - run: bin/bundle exec rubocop
-
-  rufo:
-    name: Rufo
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v4
-      - uses: ruby/setup-ruby@v1
-        with:
-          bundler-cache: true
-      - run: bin/bundle exec rufo --check app
-
-  brakeman:
-    name: Brakeman
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v4
-      - uses: ruby/setup-ruby@v1
-        with:
-          bundler-cache: true
-      - run: bin/bundle exec brakeman
-
-  terraform-fmt:
-    name: Terraform fmt
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install terraform
-        uses: hashicorp/setup-terraform@v3
-        with:
-          terraform_version: 1.10.5
-      - name: Check formatting
-        run: terraform fmt -check -recursive
-
-  tflint:
-    name: TFLint
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v4
+      - uses: hashicorp/setup-terraform@v3
       - uses: terraform-linters/setup-tflint@v4
-      - name: Run TFLint
-        working-directory: terraform
-        run: |
-          tflint --init
-          tflint --recursive
+      - uses: jdx/mise-action@v2
+        with:
+          install_args: hk pkl
+      - run: hk check

.rubocop.yml

@@ -20,11 +20,17 @@ Layout/EmptyLineAfterMagicComment:
 
 Layout/LineLength:
   AllowedPatterns: [idx_on]
+  Exclude:
+    - db/schema.rb
 
 Lint/PercentStringArray:
   Exclude:
     - spec/models/dps_export_spec.rb
 
+Rails/CreateTableWithTimestamps:
+  Exclude:
+    - db/schema.rb
+
 Rails/LexicallyScopedActionFilter:
   Exclude:
     - app/controllers/users/sessions_controller.rb
@@ -56,6 +62,12 @@ RSpec/VerifiedDoubles:
 Style/FrozenStringLiteralComment:
   Enabled: true
   EnforcedStyle: always_true
+  Exclude:
+    - db/schema.rb
+
+Style/NumericLiterals:
+  Exclude:
+    - db/schema.rb
 
 Rails/ApplicationController:
   Exclude:

.rufo

@@ -1,6 +1,8 @@
-nodejs 22.5.1
-postgres 17.2
-ruby 3.4.3
-awscli 2.13.31
-terraform 1.10.5
-tflint 0.55.1
+nodejs      22.5.1
+postgres    17.2
+ruby        3.4.3
+awscli      2.13.31
+terraform   1.10.5
+tflint      0.55.1
+pkl         0.28.1
+hk          0.8.5