Skip to content

[plan] Verify YAML dependency migration from gopkg.in/yaml.v3 #8556

Description

@github-actions

Objective

Verify that gh-aw has migrated away from the deprecated gopkg.in/yaml.v3 import path to the new canonical go.yaml.in/yaml/v3 path, aligning with Cobra v1.10.2 best practices.

Context

Cobra v1.10.2 (December 2025) migrated from gopkg.in/yaml.v3 to go.yaml.in/yaml/v3 for supply chain security improvements. We should verify gh-aw follows this pattern.

Implementation Approach

  1. Check for deprecated import:

    grep -r "gopkg.in/yaml.v3" .
  2. Check go.mod and go.sum:

    grep "gopkg.in/yaml.v3" go.mod go.sum
  3. If found, migrate:

    • Update imports: gopkg.in/yaml.v3 → go.yaml.in/yaml/v3
    • Run go mod tidy
    • Update any YAML parsing code if needed
    • Test all YAML-related functionality
  4. If not found, document:

    • Add note to AGENTS.md or DEVGUIDE.md confirming migration
    • Document YAML library choice and rationale
  5. Verify YAML parsing works correctly:

    • Test workflow compilation
    • Test frontmatter parsing
    • Test GitHub Actions YAML generation

Files to Check

  • go.mod - Dependency declarations
  • go.sum - Dependency checksums
  • All .go files with YAML imports
  • pkg/workflow/*.go - Workflow YAML handling
  • pkg/parser/*.go - Frontmatter parsing

Acceptance Criteria

  • No references to gopkg.in/yaml.v3 in codebase
  • go.mod uses canonical YAML import path (or documents why different)
  • All YAML parsing tests pass
  • Workflow compilation still works correctly
  • Documentation updated with YAML library choice

Notes

gh-aw uses goccy/go-yaml for YAML 1.1 compatibility (GitHub Actions requirement). This task verifies we're not accidentally using the deprecated gopkg.in path through transitive dependencies.

References

AI generated by Plan Command for discussion #8545

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions