Skip to content

fix: clear the sweep warnings and move YAML parsing to serde-saphyr - #15

Merged
catinspace-au merged 2 commits into
mainfrom
fix/sweep-warnings
Oct 14, 2026
Merged

catinspace-au merged 2 commits into
mainfrom
fix/sweep-warnings

Conversation

@catinspace-au

Copy link
Copy Markdown
Contributor

Clears every warning the last release left on main, and moves YAML parsing off an unmaintained crate.

  • serde_yaml_ng sits on unsafe-libyaml (RUSTSEC-2024-0449) and has had no release since 2024-05, so rule packs parse with serde-saphyr 2.0.0. The three builtin packs parse to the same values.
  • serde-saphyr runs with the fleet options: comments not emitted (a pack with 40 comment lines before an indentless rules: list failed the 32-event comment budget; there is a test for it now), strict booleans, no rendered snippet. Its Error is boxed inside LoadError so clippy's result_large_err passes.
  • .releaserc.yaml and scripts/release-prepare.py go: hyperi-ci stamps the version itself and warned on the file.
  • Zig comes from the hash-pinned ziglang wheel, not the Node 20 setup-zig action, and cargo-zigbuild is pinned.
  • The Scoop push waits for the SCOOP_BUCKET_ENABLED repo variable, so a bucket that does not exist stops 404ing the Package run.
  • The Action's curl | sh install is marked risk accepted at the line, pointing at Supply chain: install.sh checksum verification fails open, and the workflow_run chain is triggerable by a fork PR #10 for real verification.
  • .hyperi-ci.yaml uses the release: keys and drops publish.target, which hyperi-ci warned is inert.
  • markdownlint fixes in docs/release.md, docs/rules.md and packaging/README.md.

Done when CI, Cross-build and Package are green with no warnings on the release run.

unsafe-libyaml is unmaintained (RUSTSEC-2024-0449), and serde_yaml_ng has had no release since 2024-05, so the rule loader parses with serde-saphyr. The three builtin rule files parse to identical values under both.

hyperi-ci now stamps the version itself, so .releaserc.yaml and scripts/release-prepare.py go. Zig comes from the hash-pinned ziglang wheel instead of a Node 20 action, cargo-zigbuild is pinned, the Scoop push waits for SCOOP_BUCKET_ENABLED until its bucket repo exists, and the docs pass markdownlint.
A rule pack with more than 32 comment lines between rules: and an indentless sequence failed with "too many consecutive comments before resolving collection entry", because serde-saphyr buffers emitted comments against a 32-event budget. Comments are no longer emitted, so they cannot fail the parse. Only true and false read as booleans, and errors carry their position without a rendered snippet, as the rest of the fleet parses YAML.

serde_saphyr::Error is 136 bytes, so LoadError::Parse boxes it; clippy's result_large_err failed the quality gate on every function returning LoadError.

The Action's curl-pipe-sh install is marked risk accepted at the line: the script comes over TLS from the host that serves the binary, so fetching it first would add no integrity check, and #10 tracks real verification. .hyperi-ci.yaml takes the release: spelling and drops the inert publish.target.
@catinspace-au
catinspace-au merged commit 3d39ab9 into main Oct 14, 2026
19 checks passed
@catinspace-au
catinspace-au deleted the fix/sweep-warnings branch October 14, 2026 02:00
@github-actions

Copy link
Copy Markdown

Released in v1.5.11 -- https://github.com/hyperi-io/macbash/releases/tag/v1.5.11

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant