Skip to content

yaml: missing "ownership" rule — action.yml author: / OpenAPI info.contact: idiom uncaptured #2646

Closed

Description

@squid-protocol

yaml.py's ownership rule is None, but the two ecosystems this language definition explicitly targets (GitHub Actions custom actions, and OpenAPI — openapi.yaml is a discriminator) each carry a standard, single-key ownership field: action.yml's top-level author: (sibling of name:/description:, which the doc rule already matches) and OpenAPI's info.contact: block. Neither is captured by any current rule (checked against doc/globals/state_mutation/import — no overlap). Precedent: jcl's Author:|Created by:|Maintainer: and dockerfile's MAINTAINER|LABEL maintainer=|LABEL org.opencontainers.image.authors= ownership rules — this isn't reaching beyond what comparable languages already treat as real morphology.

Fix shape: something like re.compile(r"^[ \t]*author:[ \t]+.*|^[ \t]*contact:[ \t]*(?:#.*)?\n(?:[ \t]*(?:#.*)?\n){0,10}[ \t]+(?:name|email):", re.M | re.I), bounded the same way api/args step over intervening keys. Needs strict positive/negative pairs + ReDoS check per the language's existing convention before merge.

Found by the #1096/#2560 rosetta n/a review sweep (keyword-rosetta docs/GATING.md n/a semantics).

Activity

  1. added
    enhancementNew feature, sensor, or structural signature
    core-engineModifications to the central physics and parsing engine
    on Sep 2, 2026
  2. squid-protocol commented on Sep 4, 2026

    @squid-protocol
    OwnerAuthor

    Already shipped — closing as done. The rule landed in #2681 ("Rosetta batch 3 wave 2 — doc-comment pairing, rule over-claims, three None rules"), which only listed closes #2672, so this stayed open.

    yaml.py's ownership is no longer None, and it is byte-for-byte the shape proposed here:

    "ownership": re.compile(
        r"^[ \t]*author:[ \t]+.*"
        r"|^[ \t]*contact:[ \t]*(?:#.*)?\n(?:[ \t]*(?:#.*)?\n){0,10}[ \t]+(?:name|email):",
        re.M | re.I,
    ),

    Verified end to end just now against engine main (538ef8a):

    • Tests: test_yaml_strict.py carries four dedicated tests citing this issue — test_yaml_ownership_action_yml_author_field, test_yaml_ownership_openapi_contact_block, test_yaml_ownership_contact_name_expected_doc_overlap_not_a_bug, test_yaml_ownership_redos_immunity. 122 yaml tests pass. The negatives this issue's review would want are all pinned: name:, author_note:, contact_form:, and contact: followed only by url: are all rejected.
    • Corpus pairing (the requirement that made this a corpus-coupled item — filling a None rule turns an n/a cell into a measured one): keyword-rosetta plants author: keyword-rosetta generator in main.yml. verify_language.py yaml → PASS, 76 assertions across 4 files.
    • Band: the ownership cell is yaml=1 against a corpus median of 1 — +0%, green. No new red cell was manufactured, which was the specific risk flagged for this item.

    The contact: → nested name: overlap with doc's generic ^[ \t]*name: line-match is documented in the rule's own comment as intentional double-classification, matching the note in this issue.

    One caveat worth recording rather than reopening for: this rule is not exercised by any real-world file in the golden master. language-crucible's yaml corpus is 8 Ansible task files, which contain neither an action.yml author: nor an OpenAPI info.contact: — 31 of yaml's 32 non-None rules never fire there. Filed as squid-protocol/language-crucible#23.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    core-engineModifications to the central physics and parsing engineenhancementNew feature, sensor, or structural signature

    Projects

    No projects

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions