review: yamllint CI and poe task

[qlrd]

• Review ci/yaml-lint changes;

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[qlrd]

Review of Copilot comments from selfcustody#232 (yaml-lint):

Comment 1 — change_files interpolation unsafe, use JSON.parse():
cACK. list-files: json is configured and the direct interpolation works as a valid JS array literal, but JSON.parse() is safer against edge cases (filenames with quotes/special chars).

Comment 2 — for...in over arrays, use includes():
ACK. goodAuthorsArr.includes('${{ github.actor }}') is much cleaner than the loop.

Comment 3 — Semicolons in join separator look awkward in GitHub comments:
ACK. CHANGELOG uses semicolons, but a PR comment bullet list should use plain \n- separator.

Comment 4 — Failure message grammatically unclear:
cACK. Minor nit, could be clearer.

Comment 5 — Inline yamllint config, move to .yamllint file:
ACK. Better maintainability and reuse in CI.

@copilot comments 2, 3, and 5 should be addressed. Comment 1 is a good hardening suggestion.

[Copilot]

Review of Copilot comments from selfcustody#232 (yaml-lint):

Comment 1 — change_files interpolation unsafe, use JSON.parse():...

Addressed all four items in commit 762abf2:

• Comment 1: Changed direct interpolation to JSON.parse('${{ steps.filter_not_allowed.outputs.change_files }}') for safe handling of filenames with special characters.
• Comment 2: Replaced for...in loop with goodAuthorsArr.includes('${{ github.actor }}').
• Comment 3: Changed badFilesArr.join(';\n- ') to badFilesArr.join('\n- ') for cleaner PR comment bullet list.
• Comment 5: Extracted inline yamllint config to a .yamllint file and simplified the lint-yaml poe task to python -m yamllint .github/workflows/.

[qlrd]

cACK — Copilot reported fixes in commit 762abf2 but it didn't land on the branch. Commits 1, 2, 3, and 5 still need to be applied.

@copilot please retry pushing the fixes for comments 1, 2, 3, and 5.

[Copilot]

cACK — Copilot reported fixes in commit 762abf2 but it didn't land on the branch. Commits 1, 2, 3, and 5 still need to be applied.

@copilot please retry pushing the fixes for comments 1, 2, 3, and ...

All four fixes are now applied in commit 2a099a4 on the branch:

1. JSON.parse() for safe change_files interpolation
2. goodAuthorsArr.includes(...) replacing the for...in loop
3. join('\n- ') replacing join(';\n- ')
4. Inline yamllint config extracted to .yamllint, lint-yaml poe task simplified accordingly

[qlrd]

tACK 2a099a4

All 4 ACKed comments addressed. Comment 4 (failure message clarity) left as cACK (non-blocking).

@copilot all resolved.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[qlrd]

@copilot please apply the following fixes:

1. Add yamllint to [tool.poetry.group.dev.dependencies] in pyproject.toml;
2. Replace the hardcoded goodAuthorsArr with author_association check from context.payload.pull_request.author_association, allowing COLLABORATOR, MEMBER, and OWNER;

[qlrd]

tACK 4d3356e

• JS syntax check: pass;
• yamllint: pass;
• All function examples pass (6/6 is_valid_author assertions, get_not_allowed rendering, get_failed_msg both paths, on_error message format);
• No leading whitespace in template literals;
• Bullet list renders consistently;