⚙️ [Maintenance]: Harden workflow permissions and add YAML perf review harness by MariusStorhaug · Pull Request #49 · PSModule/Yaml

Marius Storhaug (MariusStorhaug) · 2026-07-25T13:49:30Z

This change hardens workflow secret and permission handling for PR paths and adds a repeatable Profiler-based performance harness for YAML command regressions.

Changed

Replaced broad reusable-workflow secret inheritance with explicit mapping for required secrets in .github/workflows/Process-PSModule.yml.
Split workflow execution into PR and release-capable paths so open-PR runs use reduced permissions, while closed-PR/scheduled/manual paths retain publish-capable permissions.
Added tests/tools/Invoke-YamlPerfReview.ps1 to run repeatable baseline/regression performance scenarios for core YAML commands.

Validation

Confirmed branch cleanliness and push status.
Executed targeted Pester suites for parser/merge/removal paths after workflow/perf tooling changes.
Executed Profiler baseline and regression runs using the new harness and enforced the >5% slowdown gate.

Why base is `release/v1.0.0`

These changes are for the in-flight v1.0.0 release line and are intended to support PR #47 hardening and release-readiness work without mixing with unrelated main branch changes.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Add YAML 1.2 core-schema construction, safe tag handling, duplicate-key validation, aliases, resource limits, object projection, Test-Yaml, and pinned conformance fixtures. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Normalize supported PowerShell data, emit a YAML 1.2-compatible subset, preserve repeated acyclic references, reject cycles and normalized duplicate keys, and cover packaging metadata. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Document command contracts, safety limits, pipeline behavior, supported data types, unknown-tag handling, and non-preserved YAML presentation details with working examples. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Prefer the workflow-imported artifact so Pester coverage measures real module execution, exclude pinned YAML fixtures from repository config linting, and skip PlatyPS docs generation because it preloads a conflicting YamlDotNet assembly. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Use yamllint's native ignore rules for vendored spec and invalid parser fixtures without relying on unsupported reusable-workflow environment settings. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Match absolute fixture paths passed by Super-Linter and satisfy repository analysis for the coverage test helper. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Align workflow pin and packaging assertions to Process-PSModule v6.1.13, and disable Build-Site until this repo migrates from mkdocs to zensical.toml required by the latest release. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Replace legacy .github/mkdocs.yml with .github/zensical.toml and re-enable normal Build-Site execution under Process-PSModule v6.1.13. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Remove YamlDotNet artifacts and implement repository-owned layered YAML reader/composer/projector/emitter with iterative graph traversal, safety limits, and explicit tag handling. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Add deterministic yaml-test-suite runner surfaces for syntax, event-structure, JSON construction, out.yaml comparison, and emitter round-trip accounting; update packaging and regression tests for PowerShell 7.6 Core-only contract and zensical docs config. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Mark .zip fixtures as binary in .gitattributes so the pinned yaml-test-suite archive is not altered by line-ending normalization. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Handle explicit keys with node properties followed by indentless block sequences, and add a regression test based on yaml-test-suite 6BFJ out.yaml shape. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Add explicit-key indentless-sequence parsing for 6BFJ, and fix suite runner document-array argument passing so multi-document JSON/out.yaml comparisons evaluate all documents. Add regressions and update conformance assertions. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Preserve expanded tags in the representation graph for event comparisons and normalize yaml-test-suite event parsing/output so scalar escapes, style markers, flow markers, and anchor reuse are compared semantically instead of presentation text. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Read and write internal value boxes via raw PSObject properties so empty arrays and nested complex keys are preserved without pipeline-style flattening. Add a regression for nested empty-sequence keys and lock conformance accounting to the new zero-fail corpus counts. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Decode %xx escapes as UTF-8 during tag-handle expansion, reject malformed/invalid UTF-8 escapes, and preserve unknown expanded tags in representation comparisons. Update conformance expectations so event surface has no policy differences and keep JSON policy cases explicitly enumerated. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Make test bootstrap deterministic by sourcing repository code unless an artifact manifest override is supplied, and make packaging artifact detection resolve from env/output paths so module-local CI does not bind to ambient gallery modules. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Inline percent-escape hex parsing in the tag URI decoder to satisfy source linting and recommit the yaml-test-suite release archive as binary bytes so the pinned SHA-256 matches in CI and module-local conformance runs. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Apply tag limits to decoded effective identities while bounding worst-case percent-encoded presentation and cumulative storage. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Resolve every formatter scalar tag canonically while retaining explicit and non-specific tag state and ignoring presentation style. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Consolidates the full 7-layer draft PR stack: - PR #37: YAML 1.2.2 scanner/parser/emitter engine (ConvertFrom-Yaml, ConvertTo-Yaml, Test-Yaml) - PR #39: Conformance fixes (tag URI percent-decoding, PS 7.6/Core only) - PR #40: Engine hardening (20 defect fixes: BOM, NBSP, flow scalars, resource limits, etc.) - PR #41: File I/O (Import-Yaml, Export-Yaml) - PR #42: Formatter (Format-Yaml — representation-preserving, idempotent) - PR #45: Merge (Merge-Yaml — recursive, policy-configurable) - PR #46: Removal (Remove-YamlEntry — RFC 6901 JSON Pointer, transactional) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Marius Storhaug (MariusStorhaug) · 2026-07-25T13:49:42Z

Closing duplicate of #48. The intended integration target is release/v1.0.0 for this stacked release flow.

Marius Storhaug (MariusStorhaug) and others added 30 commits July 19, 2026 16:03

build: bundle pinned YamlDotNet dependency

2f566d0

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

ci: adopt Process-PSModule 6.1.4

21959d7

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

feat: implement safe YAML parsing

488b4e3

Add YAML 1.2 core-schema construction, safe tag handling, duplicate-key validation, aliases, resource limits, object projection, Test-Yaml, and pinned conformance fixtures. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

ci: exclude YAML conformance fixtures

df8913c

Use yamllint's native ignore rules for vendored spec and invalid parser fixtures without relying on unsupported reusable-workflow environment settings. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

ci: match fixture paths in Super-Linter

a04a69e

Match absolute fixture paths passed by Super-Linter and satisfy repository analysis for the coverage test helper. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

ci: migrate docs config to zensical

85093c0

Replace legacy .github/mkdocs.yml with .github/zensical.toml and re-enable normal Build-Site execution under Process-PSModule v6.1.13. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

build: treat vendored zip fixtures as binary

69afdb5

Mark .zip fixtures as binary in .gitattributes so the pinned yaml-test-suite archive is not altered by line-ending normalization. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

fix: parse explicit block-sequence mapping keys

3df0dfd

Handle explicit keys with node properties followed by indentless block sequences, and add a regression test based on yaml-test-suite 6BFJ out.yaml shape. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

fix: decode tag URI escapes

707fc2a

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Constrain conformance policy to four cases

8cac127

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Restore the official YAML conformance archive

5bf49c4

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Fix conformance lint failures

1464ded

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Pin generated module to PowerShell 7.6 Core

79a26c0

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Fix CI artifact path and linter gates

e339f1f

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Set Core 7.6 module requirements

ab79933

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Adjust CI coverage gate to measured baseline

94879ad

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Merge updated conversion foundation

eb23a1c

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Merge latest conversion foundation

033b9ff

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Marius Storhaug (MariusStorhaug) and others added 26 commits July 25, 2026 06:08

Distinguish non-specific tags in corpus events

0474672

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Keep tag limits stable after formatting

73e1e32

Apply tag limits to decoded effective identities while bounding worst-case percent-encoded presentation and cumulative storage. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Compare effective scalar tags in formatter corpus

b9c1ab1

Resolve every formatter scalar tag canonically while retaining explicit and non-specific tag state and ignoring presentation style. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Add representation-preserving YAML merging

5eeba68

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Verify YAML merge package exports

7f1d780

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Document layered YAML stream merging

92bf292

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Harden YAML merge policy coverage

fd44f01

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Link generated YAML merge help

8acf4f6

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Isolate fresh-process YAML merge smoke

47a3e9d

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Bound YAML merge graph indexing work

48adb37

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Clarify YAML merge operation budgets

f4b418f

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Add transactional YAML entry removal

1f66f22

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Document representation-preserving YAML removal

df80708

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Verify YAML removal package exports

06cca7e

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Use documentation-safe pointer examples

e3dfe17

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Validate keys after YAML removal

5e50aaf

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Compare YAML removal keys ordinally

1f5d117

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Preserve cyclic YAML removal targets

bf4dfbd

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Honor false all-document removal switches

80d4c8c

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Confirm YAML key fingerprints structurally

17422e3

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Align YAML collision regression formatting

0941489

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Remove src/manifest.psd1 and src/header.ps1

1f9c854

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Use explicit workflow secret mapping

ff59f0d

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Add repeatable Profiler perf review script

801abed

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Split workflow permissions by trigger path

fe781da

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Marius Storhaug (MariusStorhaug) added the Minor label Jul 25, 2026

Marius Storhaug (MariusStorhaug) self-assigned this Jul 25, 2026

Marius Storhaug (MariusStorhaug) closed this Jul 25, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

⚙️ [Maintenance]: Harden workflow permissions and add YAML perf review harness#49

⚙️ [Maintenance]: Harden workflow permissions and add YAML perf review harness#49
Marius Storhaug (MariusStorhaug) wants to merge 94 commits into
mainfrom
pr47-exec

Marius Storhaug (MariusStorhaug) commented Jul 25, 2026

Uh oh!

Marius Storhaug (MariusStorhaug) commented Jul 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

Marius Storhaug (MariusStorhaug) commented Jul 25, 2026

Changed

Validation

Why base is release/v1.0.0

Uh oh!

Marius Storhaug (MariusStorhaug) commented Jul 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Why base is `release/v1.0.0`