refactor: add clone_queue module, use config from meta_core

[mateodelnorte]

Summary

• Add clone_queue module with CloneQueue and CloneTask (moved from meta_git_cli)
• Update worktree/helpers.rs imports to use meta_core::config instead of meta_cli::config

Merge order

Merge after: gitkb/meta_core#3

Test plan

• cargo build --workspace passes
• cargo test --workspace passes

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features

  • Adds a task queue for managing repository clones with deduplication, recursive discovery and configurable depth limits.

• Refactor

  • Project configuration handling unified to a consolidated core config API (root injection preserved).

• CI / Workflows

  • Workflows now prepare a multi-repo workspace and run formatting/tests in that workspace context.

• Chores

  • YAML parsing dependency switched to an updated serde YAML crate.

• Tests

  • New unit tests covering queue behavior, deduplication, discovery and depth limits.

[coderabbitai]

Walkthrough

Adds a new thread-safe clone task queue module for recursive, depth-limited repository discovery and queuing; migrates worktree helpers from meta_cli::config to meta_core::config and switches YAML parsing to serde_yaml_ng; updates CI/workflow to build a multi-repo Rust workspace and adjust formatting steps.

Changes

Cohort / File(s)	Summary
Clone Queue src/clone_queue.rs	New public module: CloneTask and CloneQueue with thread-safe pending/completed/failed state, deduplication, nested .meta discovery (push_from_meta), depth limits, atomic counters, take_one/drain_all/mark_completed/mark_failed API, and unit tests.
Module Export src/lib.rs	Exports the new module via pub mod clone_queue;.
Worktree Helpers (config migration & YAML) src/worktree/helpers.rs	Replaced meta_cli::config usages with meta_core::config, updated function signatures/returns to use meta_core::config::ProjectInfo, injects root ProjectInfo with meta: false, and switched YAML parsing to serde_yaml_ng.
CI Workflows (multi-repo workspace) .github/workflows/auto-format.yml, .github/workflows/ci.yml	Replace repeated clone steps with a loop/fallback cloning multiple repos; create a workspace Cargo.toml and VERSION; run formatting and commits from meta_git_lib working-directory; unify workspace setup across jobs.
Dependency update Cargo.toml	Replaced serde_yaml = "0.9" with serde_yaml_ng = "0.10" in dependencies.

Sequence Diagram(s)

sequenceDiagram
  participant Worker as Worker (thread)
  participant Queue as CloneQueue
  participant FS as Filesystem/.meta
  participant Git as Git (clone)

  Worker->>Queue: take_one()
  alt task available
    Queue-->>Worker: CloneTask
    Worker->>Git: git clone (task.url, depth=git_depth)
    Git-->>Worker: clone result
    alt success
      Worker->>Queue: mark_completed(task)
      Queue->>FS: push_from_meta(task.target_path, task.depth_level + 1)
      FS-->>Queue: discovered tasks
      Queue-->>Queue: enqueue discovered tasks (dedupe)
    else failure
      Worker->>Queue: mark_failed(task)
    end
  else no task
    Queue-->>Worker: None
  end

Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Poem

🐇 I tunneled paths of tasks and time,

Roots found metas, branches climb,
Hooks and queues in tidy rows,
More clonal sprouts where’er I go,
A rabbit queues what builders prime.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the two main changes: adding a clone_queue module and refactoring to use config from meta_core instead of meta_cli.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Merge Conflict Detection	✅ Passed	✅ No merge conflicts detected when merging into main

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch refactor/move-config-to-meta-core

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 2

🤖 Fix all issues with AI agents

In `@src/clone_queue.rs`:
- Around line 55-78: The push method has a TOCTOU window because it locks
completed and pending separately; change it to acquire both mutexes together (in
a consistent order, e.g., lock completed then pending) before performing the
checks so the check for completed.contains(&path) and the check for
pending.iter().any(|t| t.target_path == path) are done atomically, then push the
CloneTask and increment total_discovered; keep using unwrap_or_else(|e|
e.into_inner()) for both locks to preserve current error handling and ensure you
don't introduce deadlocks by always locking the two Mutexes in the same order.
- Around line 198-203: Replace the eprintln! call that prints the meta warning
with log::warn! so logging is consistent with the rest of the module;
specifically change the block that checks task.is_meta && added == 0 to call
warn!("warning: '{}' is declared with `meta: true` but no .meta config was found
inside it", task.name). Ensure the log::warn macro is in scope (add use
log::warn; or call log::warn! fully-qualified) so the warning respects the
application's logging configuration.

[coderabbitai]

Actionable comments posted: 4

🤖 Fix all issues with AI agents

In @.github/workflows/auto-format.yml:
- Around line 30-36: The workflow currently constructs BRANCH directly from
github.head_ref/github.ref_name which can allow script injection; change the
BRANCH assignment to read a pre-set environment input (e.g., an env var like
BRANCH or INPUT_BRANCH supplied to the job) and do not interpolate
github.head_ref directly in the shell. Update the clone loop that uses BRANCH
(the for repo in ... git clone ... -b "$BRANCH") to instead use that safe env
var, and also add a simple sanitization step (strip newlines/control characters
or allow only a safe character class) before passing BRANCH into git clone to
ensure malicious branch names cannot inject shell content.

In @.github/workflows/ci.yml:
- Around line 35-52: The three repeated steps ("Clone dependencies", "Create
workspace Cargo.toml", and "Create VERSION file") should be extracted into a
reusable local composite action (e.g., named setup-workspace) and replaced in
the test, clippy, and format jobs with a single uses line; implement the
composite action to run the git clone and the two shell blocks that write
Cargo.toml and VERSION, expose any inputs if needed (e.g., workspace members or
version string), update each job to call this new action, and remove the
duplicate step blocks from the workflow to ensure consistency and easier
maintenance.
- Around line 29-33: The BRANCH assignment and git clone loop currently
interpolate the untrusted expression github.head_ref directly into the shell,
enabling command injection; instead, expose the branch value via a job env
variable (e.g., SAFE_BRANCH) set from github.head_ref or github.ref_name, then
in the script use the env var (BRANCH or SAFE_BRANCH) only as a quoted argument
to git clone (and perform a simple allowlist/sanitization that strips or rejects
characters outside a safe set like alphanumerics, dot, dash, underscore, slash)
before calling --branch "$BRANCH"; apply the same change to the clippy and
format jobs so they also stop directly interpolating github.head_ref/ref_name
into the shell.

In `@Cargo.toml`:
- Line 21: The Cargo.toml dependency serde_yml = "0.0.12" is unmaintained and
must be replaced; edit Cargo.toml to remove serde_yml and add a maintained
alternative such as serde_yaml_ng = "<choose-appropriate-version>" (or
serde_norway / the maintained serde-yaml fork), then update all crate references
in the code (e.g., any use/import paths from serde_yml::... or extern crate
serde_yml to the new crate name like serde_yaml_ng::...) and adjust any API
differences if needed; finally run cargo update and cargo test to verify builds
and update Cargo.lock.

[coderabbitai]

Actionable comments posted: 2

🤖 Fix all issues with AI agents

In @.github/workflows/auto-format.yml:
- Around line 45-57: The heredoc used for creating Cargo.toml in the GitHub
Action contains leading spaces on each content line, which will write invalid
indented TOML; update the step that runs cat > Cargo.toml << 'EOF' so the
heredoc lines are left-aligned (remove the leading indentation from the block
between EOF markers) or otherwise generate the file without indentation,
ensuring the literal lines like [workspace], members = [...], and
[workspace.package] are at column 0.

In @.github/workflows/ci.yml:
- Around line 42-55: The heredoc in the "Create workspace Cargo.toml" run step
is indented so the generated Cargo.toml contains leading spaces and is invalid
TOML; fix by ensuring the heredoc body is not indented (move the [workspace]...
EOF block to be left-aligned in the run block) or replace the heredoc with a
non-indented writer (e.g., printf or echo with explicit newlines) so the written
Cargo.toml has no leading whitespace; apply the same change to the identical
steps in the clippy and format jobs.