refactor(config): standardize the workspace on serde_yaml_ng for YAML parsing#1447
Merged
mergify[bot] merged 2 commits intoMay 29, 2026
Conversation
This was referenced May 19, 2026
This was referenced May 19, 2026
Member
Author
|
This pull request is part of a Mergify stack:
|
This was referenced May 19, 2026
Contributor
Merge ProtectionsYour pull request matches the following merge protections and will not be merged until they are valid. 🟢 ⛓️ Depends-On RequirementsWonderful, this rule succeeded.Requirement based on the presence of
🟢 🤖 Continuous IntegrationWonderful, this rule succeeded.
🟢 👀 Review RequirementsWonderful, this rule succeeded.
🟢 Enforce conventional commitWonderful, this rule succeeded.Make sure that we follow https://www.conventionalcommits.org/en/v1.0.0/
🟢 🔎 ReviewsWonderful, this rule succeeded.
🟢 📕 PR descriptionWonderful, this rule succeeded.
|
sileht
previously approved these changes
May 20, 2026
jd
force-pushed
the
devs/jd/worktree-rust-port/standardize-workspace-serde-yaml-ng-yaml-parsing--f5d28d2c
branch
from
eb8ab2e to
64b2cf0
Compare
jd
force-pushed
the
devs/jd/worktree-rust-port/swap-uuid-getrandom-gha-heredoc-delimiter--b6599e9b
branch
from
2cd6b4f to
5cd88c9
Compare
Member
Author
Revision history
|
jd
force-pushed
the
devs/jd/worktree-rust-port/standardize-workspace-serde-yaml-ng-yaml-parsing--f5d28d2c
branch
from
47ac6dc to
fb6f38c
Compare
jd
force-pushed
the
devs/jd/worktree-rust-port/swap-uuid-getrandom-gha-heredoc-delimiter--b6599e9b
branch
from
9a6412d to
e95b052
Compare
jd
force-pushed
the
devs/jd/worktree-rust-port/standardize-workspace-serde-yaml-ng-yaml-parsing--f5d28d2c
branch
from
fb6f38c to
3105241
Compare
JulianMaurin
previously approved these changes
May 28, 2026
jd
force-pushed
the
devs/jd/worktree-rust-port/standardize-workspace-serde-yaml-ng-yaml-parsing--f5d28d2c
branch
from
3105241 to
2f82693
Compare
jd
force-pushed
the
devs/jd/worktree-rust-port/swap-uuid-getrandom-gha-heredoc-delimiter--b6599e9b
branch
from
e95b052 to
aa78c91
Compare
mergify
Bot
dismissed
JulianMaurin’s stale review
Pull request has been modified.
JulianMaurin
previously approved these changes
May 29, 2026
`ci queue-info::write_github_output` formatted a unique `ghadelimiter_<uuid-v4>` to guard against a metadata payload that happens to contain its own heredoc delimiter. The actual contract is "32 unpredictable hex chars", not "a UUID per RFC 4122" — the delimiter is never parsed by anyone, only matched as a string. Pull 16 random bytes straight from `getrandom::fill` and hex-encode them. Drops `uuid` from the direct deps (it stays unreferenced and disappears from `Cargo.lock`), with `getrandom` taking its place — which `uuid` was already pulling in transitively, so the net add is zero new code shipped to the binary. The local helper is six lines. Same blast radius for a maintainer-attack story, smaller surface to read. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> Change-Id: Ib6599e9b6fca49281186b726a63e4641fa32596e
… parsing
The workspace had two YAML parsers — both forks of the archived
`dtolnay/serde-yaml`. `mergify-config` used `serde_norway` for
`.mergify.yml`; `mergify-ci` used `serde_yaml_ng` for merge-queue
metadata in PR bodies and git notes. Same job, two crates, two
transitive `unsafe-libyaml*` trees in Cargo.lock.
Standardize on `serde_yaml_ng` for both. The decision is grounded
in concrete signal, not vibe:
Metric serde_norway serde_yaml_ng
───────────────────────── ───────────── ─────────────
Reverse-deps on lib.rs 229 (78 dir.) 618 (349 dir.)
GitHub stars 53 109
Last commit 2025-08-04 2025-09-14
Bus factor (recent prs) 1 (solo) merges externals
Maintainer statement v0.9.40 title README: explicit
"I'm gonna upstream-compat
maintain this" intent
unsafe-libyaml backend forked ("…- canonical
norway")
Open since 2024-06-10 2024-05-03
License Apache-2.0 MIT (= upstream)
`serde_yaml_ng` wins on every axis that matters for the "will this
still be alive in two years" question: three-times the ecosystem
adoption, more recent activity, accepts third-party PRs, declares
the maintenance commitment in writing, and uses the canonical
`unsafe-libyaml` rather than a parallel-fork backend.
Functional surface is identical for both of our use shapes —
`from_str` to a typed struct for ci, `from_str` to `Value`
then convert to `serde_json::Value` for config validation.
Migration is purely a rename at the one call site.
Cargo.lock drops `serde_norway` and `unsafe-libyaml-norway`.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Change-Id: If5d28d2c4259127181bace5bafb0ac02c78d8f7b
jd
force-pushed
the
devs/jd/worktree-rust-port/standardize-workspace-serde-yaml-ng-yaml-parsing--f5d28d2c
branch
from
2f82693 to
f4fe757
Compare
mergify
Bot
dismissed
JulianMaurin’s stale review
Pull request has been modified.
Base automatically changed from
devs/jd/worktree-rust-port/swap-uuid-getrandom-gha-heredoc-delimiter--b6599e9b
to
main
May 29, 2026 07:06
kozlek
approved these changes
May 29, 2026
JulianMaurin
approved these changes
May 29, 2026
Contributor
Merge Queue Status
This pull request spent 16 minutes 26 seconds in the queue, including 16 minutes running CI. Required conditions to merge
|
This was referenced May 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The workspace had two YAML parsers — both forks of the archived
dtolnay/serde-yaml.mergify-configusedserde_norwayfor.mergify.yml;mergify-ciusedserde_yaml_ngfor merge-queuemetadata in PR bodies and git notes. Same job, two crates, two
transitive
unsafe-libyaml*trees in Cargo.lock.Standardize on
serde_yaml_ngfor both. The decision is groundedin concrete signal, not vibe:
Metric serde_norway serde_yaml_ng
───────────────────────── ───────────── ─────────────
Reverse-deps on lib.rs 229 (78 dir.) 618 (349 dir.)
GitHub stars 53 109
Last commit 2025-08-04 2025-09-14
Bus factor (recent prs) 1 (solo) merges externals
Maintainer statement v0.9.40 title README: explicit
"I'm gonna upstream-compat
maintain this" intent
unsafe-libyaml backend forked ("…- canonical
norway")
Open since 2024-06-10 2024-05-03
License Apache-2.0 MIT (= upstream)
serde_yaml_ngwins on every axis that matters for the "will thisstill be alive in two years" question: three-times the ecosystem
adoption, more recent activity, accepts third-party PRs, declares
the maintenance commitment in writing, and uses the canonical
unsafe-libyamlrather than a parallel-fork backend.Functional surface is identical for both of our use shapes —
from_strto a typed struct for ci,from_strtoValuethen convert to
serde_json::Valuefor config validation.Migration is purely a rename at the one call site.
Cargo.lock drops
serde_norwayandunsafe-libyaml-norway.Co-Authored-By: Claude Opus 4.7 noreply@anthropic.com
Depends-On: #1446