chore: release v2.7.0

[jdx]

https://entire.io/gh/jdx/hk/trails/252

🚀 Features

• (builtins) report jactionlint findings as SARIF and apply its fixes by @jdx in #1687
• (builtins) add Herb formatter and linter by @beauraF in #1706
• (builtins) add ansible-lint linter by @illesnagy1 in #1707
• (builtins) add packer fmt formatter by @illesnagy1 in #1708
• (step) add profile_condition to enable steps with and/or/not over profiles by @jdx in #1684
• (validate) add --json output and --deny-warnings to fail on warnings by @jdx in #1699

🐛 Bug Fixes

• (builtins) stop passing file arguments to brakeman by @beauraF in #1704
• (config) keep output.log, hk.log and patches in the repository's git dir by @jdx in #1705
• (step) show rendered findings instead of raw SARIF in failed check output by @jdx in #1695

📚 Documentation

• refresh competitor benchmark for v2.6.0 by @jdx in #1688

🛡️ Security

• (ci) remove claude-code-action workflow by @jdx in #1694
• (deps) update mise tools by @renovate[bot] in #1689
• (deps) bump jactionlint to 2.2.0 and mbx to 1.24.0 by @jdx in #1700
• recommend oxfmt over prettier in examples and getting started by @jdx in #1711

🔍 Other Changes

• (release) shorten minimum release age to 2 days by @jdx in bd30b5d

📦️ Dependency Updates

• update github actions by @renovate[bot] in #1690
• update actions/checkout action to v7 by @renovate[bot] in #1691
• update dependency preact to v11 by @renovate[bot] in #1692
• update node.js to v26.11.1 by @renovate[bot] in #1696
• update rustls to 0.23.46 by @jdx in #1701
• update rust crate usage-rs to v7.0.1 by @renovate[bot] in #1702

New Contributors

• @beauraF made their first contribution in #1706

---

Note

Low Risk
Release housekeeping and version pins only; user-facing behavior changes were merged in earlier PRs included in the changelog.

Overview
Release v2.7.0 — bumps the crate/binary and generated CLI metadata from 2.6.0 to 2.7.0, adds the 2.7.0 section to CHANGELOG.md, and rewrites docs and example hk.pkl snippets to pin package://…/v2.7.0/hk@2.7.0 imports.

What ships in this tag (documented in the changelog, not introduced in this diff): new builtins (Herb, ansible-lint, packer fmt), richer jactionlint SARIF/fix support, profile_condition for boolean profile logic on steps, hk validate --json and --deny-warnings, fixes for Brakeman file args, log/patch paths under the repo git dir, and human-readable findings instead of raw SARIF on failed checks, plus CI/deps/doc updates.

^{Reviewed by Cursor Bugbot for commit c62e8ae. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Ignore keyword(s) in the title.

⛔ Ignored keywords: 2

• chore: release
• chore(main): release

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)
• Review profile: CHILL
• Plan: Advanced
• Run ID: d23755a3-dff6-433b-a475-70e36c896d15

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Confidence Score: 5/5

[Low impact] The release changes appear safe to merge.

Summary

Prepares the 2.7.0 release.

• hk's release metadata and examples now point to v2.7.0.

No actionable issues were found in these changes.

_{Reviews (21) · Last reviewed commit: "chore: release v2.7.0" · Reviewed by Greptile}

[github-actions]

Instruction counts

benchmark	trend	instructions	Δ	wall (min)	Δ
builtins	▇▇▂▂▂▂▂▂▂▂▁▁▁▁▂▂▃▃█	1,954,431 → 1,961,815	+0.38%	2.85 → 2.82ms	-1.14%
check	—	—	—	18.85 → 18.83ms	-0.13%
config-cold	▃▂▂▂▂▂▂▂▁▁▂▂▂█████▅	120,094,413 → 119,995,948	-0.08%	29.02 → 29.03ms	+0.03%
stash	▄▅▁▂▁▁▁▂▂▂▁▂▁▂▃▃▃▃█	53,803,101 → 54,494,950	+1.29% ⚠️	311.72 → 310.14ms	-0.51%
usage	████████████▁▃▃▃▃▃▃	4,382,865 → 4,355,267	-0.63%	4.76 → 4.74ms	-0.24%
validate	—	—	—	17.90 → 18.27ms	+2.11%

1 benchmark(s) above the 1% gate: stash +1.29%

_{Only instruction counts gate. Wall clock is shown for context — on identical hardware it moves 4-20% run to run.}

_{Measured by tak — instruction-counted CLI benchmarks, stored in this repository's git notes.}

_{0d65d715d655 vs bd30b5d7eb3d · measured on the runner, not pushed to the history.}

Dismissed because a newer commit was pushed; Greptile will re-review the current head.

Dismissed because a newer commit was pushed; Greptile will re-review the current head.

Dismissed because a newer commit was pushed; Greptile will re-review the current head.

Dismissed because a newer commit was pushed; Greptile will re-review the current head.

Dismissed because a newer commit was pushed; Greptile will re-review the current head.

Dismissed because a newer commit was pushed; Greptile will re-review the current head.

Dismissed because a newer commit was pushed; Greptile will re-review the current head.

Dismissed because a newer commit was pushed; Greptile will re-review the current head.

Dismissed because a newer commit was pushed; Greptile will re-review the current head.

Dismissed because a newer commit was pushed; Greptile will re-review the current head.

Dismissed because a newer commit was pushed; Greptile will re-review the current head.

Dismissed because a newer commit was pushed; Greptile will re-review the current head.

Dismissed because a newer commit was pushed; Greptile will re-review the current head.

Dismissed because a newer commit was pushed; Greptile will re-review the current head.

Dismissed because a newer commit was pushed; Greptile will re-review the current head.

Dismissed because a newer commit was pushed; Greptile will re-review the current head.

Dismissed because a newer commit was pushed; Greptile will re-review the current head.