fix: switch lib to parse yaml

__tests__/fixtures/goreleaser-anchors.yml

@@ -0,0 +1,8 @@
+x-build: &build_base
+  env:
+    - CGO_ENABLED=0
+
+project_name: test
+dist: /foo
+builds:
+  - <<: *build_base

__tests__/fixtures/goreleaser-dist.yaml

@@ -0,0 +1,15 @@
+env:
+  - GO111MODULE=on
+
+dist: /bar
+
+builds:
+- env:
+    - CGO_ENABLED=0
+  goos:
+    - linux
+    - darwin
+    - windows
+  goarch:
+    - amd64
+    - arm64

__tests__/fixtures/goreleaser-invalid.yaml

@@ -0,0 +1,8 @@
+&shared:
+  build: &build_base
+    env:
+      - CGO_ENABLED=0
+
+project_name: test
+builds:
+  - <<: *build_base

__tests__/fixtures/goreleaser-nodist.yaml

@@ -0,0 +1,352 @@
+# https://raw.githubusercontent.com/goreleaser/goreleaser/main/.goreleaser.yaml
+env:
+  - GO111MODULE=on
+
+before:
+  hooks:
+    - go mod tidy
+    - ./scripts/completions.sh
+    - ./scripts/manpages.sh
+
+snapshot:
+  name_template: '{{ incpatch .Version }}-next'
+
+gomod:
+  proxy: true
+
+report_sizes: true
+
+builds:
+- env:
+    - CGO_ENABLED=0
+  goos:
+    - linux
+    - darwin
+    - windows
+  goarch:
+    - "386"
+    - amd64
+    - arm
+    - arm64
+    - ppc64
+  goarm:
+    - "7"
+  ignore:
+    - goos: windows
+      goarch: arm
+  mod_timestamp: '{{ .CommitTimestamp }}'
+  flags:
+    - -trimpath
+  ldflags:
+    - -s -w -X main.version={{.Version}} -X main.commit={{.Commit}} -X main.date={{ .CommitDate }} -X main.builtBy=goreleaser -X main.treeState={{ .IsGitDirty }}
+
+universal_binaries:
+- replace: false
+
+# temporarely disables until we add better filters for platforms et al, and test more.
+# upx:
+#   - enabled: true
+
+checksum:
+  name_template: 'checksums.txt'
+
+changelog:
+  sort: asc
+  use: github
+  filters:
+    exclude:
+    - '^test:'
+    - '^chore'
+    - 'merge conflict'
+    - Merge pull request
+    - Merge remote-tracking branch
+    - Merge branch
+    - go mod tidy
+  groups:
+    - title: Dependency updates
+      regexp: '^.*?(feat|fix)\(deps\)!?:.+$'
+      order: 300
+    - title: 'New Features'
+      regexp: '^.*?feat(\([[:word:]]+\))??!?:.+$'
+      order: 100
+    - title: 'Security updates'
+      regexp: '^.*?sec(\([[:word:]]+\))??!?:.+$'
+      order: 150
+    - title: 'Bug fixes'
+      regexp: '^.*?fix(\([[:word:]]+\))??!?:.+$'
+      order: 200
+    - title: 'Documentation updates'
+      regexp: ^.*?doc(\([[:word:]]+\))??!?:.+$
+      order: 400
+    - title: 'Build process updates'
+      regexp: ^.*?build(\([[:word:]]+\))??!?:.+$
+      order: 400
+    - title: Other work
+      order: 9999
+
+dockers:
+- image_templates:
+  - 'goreleaser/goreleaser:{{ .Tag }}-amd64'
+  - 'ghcr.io/goreleaser/goreleaser:{{ .Tag }}-amd64'
+  dockerfile: Dockerfile
+  use: buildx
+  build_flag_templates:
+  - "--pull"
+  - "--label=io.artifacthub.package.readme-url=https://raw.githubusercontent.com/goreleaser/goreleaser/main/README.md"
+  - "--label=io.artifacthub.package.logo-url=https://goreleaser.com/static/avatar.png"
+  - "--label=io.artifacthub.package.maintainers=[{\"name\":\"Carlos Alexandro Becker\",\"email\":\"carlos@carlosbecker.dev\"}]"
+  - "--label=io.artifacthub.package.license=MIT"
+  - "--label=org.opencontainers.image.description=Deliver Go binaries as fast and easily as possible"
+  - "--label=org.opencontainers.image.created={{.Date}}"
+  - "--label=org.opencontainers.image.name={{.ProjectName}}"
+  - "--label=org.opencontainers.image.revision={{.FullCommit}}"
+  - "--label=org.opencontainers.image.version={{.Version}}"
+  - "--label=org.opencontainers.image.source={{.GitURL}}"
+  - "--platform=linux/amd64"
+  extra_files:
+  - scripts/entrypoint.sh
+- image_templates:
+  - 'goreleaser/goreleaser:{{ .Tag }}-arm64'
+  - 'ghcr.io/goreleaser/goreleaser:{{ .Tag }}-arm64'
+  dockerfile: Dockerfile
+  use: buildx
+  build_flag_templates:
+  - "--pull"
+  - "--label=io.artifacthub.package.readme-url=https://raw.githubusercontent.com/goreleaser/goreleaser/main/README.md"
+  - "--label=io.artifacthub.package.logo-url=https://goreleaser.com/static/avatar.png"
+  - "--label=io.artifacthub.package.maintainers=[{\"name\":\"Carlos Alexandro Becker\",\"email\":\"carlos@carlosbecker.dev\"}]"
+  - "--label=io.artifacthub.package.license=MIT"
+  - "--label=org.opencontainers.image.description=Deliver Go binaries as fast and easily as possible"
+  - "--label=org.opencontainers.image.created={{.Date}}"
+  - "--label=org.opencontainers.image.name={{.ProjectName}}"
+  - "--label=org.opencontainers.image.revision={{.FullCommit}}"
+  - "--label=org.opencontainers.image.version={{.Version}}"
+  - "--label=org.opencontainers.image.source={{.GitURL}}"
+  - "--platform=linux/arm64"
+  goarch: arm64
+  extra_files:
+  - scripts/entrypoint.sh
+
+docker_manifests:
+- name_template: 'goreleaser/goreleaser:{{ .Tag }}'
+  image_templates:
+  - 'goreleaser/goreleaser:{{ .Tag }}-amd64'
+  - 'goreleaser/goreleaser:{{ .Tag }}-arm64'
+- name_template: 'ghcr.io/goreleaser/goreleaser:{{ .Tag }}'
+  image_templates:
+  - 'ghcr.io/goreleaser/goreleaser:{{ .Tag }}-amd64'
+  - 'ghcr.io/goreleaser/goreleaser:{{ .Tag }}-arm64'
+- name_template: 'goreleaser/goreleaser:latest'
+  image_templates:
+  - 'goreleaser/goreleaser:{{ .Tag }}-amd64'
+  - 'goreleaser/goreleaser:{{ .Tag }}-arm64'
+- name_template: 'ghcr.io/goreleaser/goreleaser:latest'
+  image_templates:
+  - 'ghcr.io/goreleaser/goreleaser:{{ .Tag }}-amd64'
+  - 'ghcr.io/goreleaser/goreleaser:{{ .Tag }}-arm64'
+
+archives:
+  - name_template: >-
+      {{ .ProjectName }}_
+      {{- title .Os }}_
+      {{- if eq .Arch "amd64" }}x86_64
+      {{- else if eq .Arch "386" }}i386
+      {{- else }}{{ .Arch }}{{ end }}
+      {{- if .Arm }}v{{ .Arm }}{{ end }}
+    format_overrides:
+    - goos: windows
+      format: zip
+    builds_info:
+      group: root
+      owner: root
+    rlcp: true
+    files:
+      - README.md
+      - LICENSE.md
+      - completions/*
+      - manpages/*
+
+brews:
+  - tap:
+      owner: goreleaser
+      name: homebrew-tap
+    folder: Formula
+    goarm: "7"
+    homepage:  https://goreleaser.com
+    description: Deliver Go binaries as fast and easily as possible
+    license: MIT
+    test: |
+      system "#{bin}/goreleaser -v"
+    dependencies:
+    - name: go
+      type: optional
+    - name: git
+    conflicts:
+    - goreleaser-pro
+    install: |-
+      bin.install "goreleaser"
+      bash_completion.install "completions/goreleaser.bash" => "goreleaser"
+      zsh_completion.install "completions/goreleaser.zsh" => "_goreleaser"
+      fish_completion.install "completions/goreleaser.fish"
+      man1.install "manpages/goreleaser.1.gz"
+
+aurs:
+  - homepage:  https://goreleaser.com
+    description: Deliver Go binaries as fast and easily as possible
+    maintainers:
+      - 'Fernandez Ludovic <lfernandez dot dev at gmail dot com>'
+      - 'Carlos Alexandro Becker <carlos at becker dot software>'
+    license: MIT
+    private_key: '{{ .Env.AUR_KEY }}'
+    git_url: 'ssh://aur@aur.archlinux.org/goreleaser-bin.git'
+    package: |-
+      # bin
+      install -Dm755 "./goreleaser" "${pkgdir}/usr/bin/goreleaser"
+
+      # license
+      install -Dm644 "./LICENSE.md" "${pkgdir}/usr/share/licenses/goreleaser/LICENSE"
+
+      # completions
+      mkdir -p "${pkgdir}/usr/share/bash-completion/completions/"
+      mkdir -p "${pkgdir}/usr/share/zsh/site-functions/"
+      mkdir -p "${pkgdir}/usr/share/fish/vendor_completions.d/"
+      install -Dm644 "./completions/goreleaser.bash" "${pkgdir}/usr/share/bash-completion/completions/goreleaser"
+      install -Dm644 "./completions/goreleaser.zsh" "${pkgdir}/usr/share/zsh/site-functions/_goreleaser"
+      install -Dm644 "./completions/goreleaser.fish" "${pkgdir}/usr/share/fish/vendor_completions.d/goreleaser.fish"
+
+      # man pages
+      install -Dm644 "./manpages/goreleaser.1.gz" "${pkgdir}/usr/share/man/man1/goreleaser.1.gz"
+
+scoops:
+  - bucket:
+      owner: goreleaser
+      name: scoop-bucket
+    folder: bucket
+    homepage:  https://goreleaser.com
+    description: Deliver Go binaries as fast and easily as possible
+    license: MIT
+
+nfpms:
+  - file_name_template: '{{ .ConventionalFileName }}'
+    id: packages
+    homepage:  https://goreleaser.com
+    description: |-
+      Deliver Go binaries as fast and easily as possible.
+      GoReleaser allows you to release easily build, package, publish and
+      announce to several places at one go.
+    maintainer: Carlos Alexandro Becker <carlos@becker.software>
+    license: MIT
+    vendor: GoReleaser
+    bindir: /usr/bin
+    section: utils
+    contents:
+      - src: ./completions/goreleaser.bash
+        dst: /usr/share/bash-completion/completions/goreleaser
+        file_info:
+          mode: 0644
+      - src: ./completions/goreleaser.fish
+        dst: /usr/share/fish/vendor_completions.d/goreleaser.fish
+        file_info:
+          mode: 0644
+      - src: ./completions/goreleaser.zsh
+        dst:  /usr/share/zsh/vendor-completions/_goreleaser
+        file_info:
+          mode: 0644
+      - src: ./manpages/goreleaser.1.gz
+        dst: /usr/share/man/man1/goreleaser.1.gz
+        file_info:
+          mode: 0644
+      - src: ./LICENSE.md
+        dst: /usr/share/doc/goreleaser/copyright
+        file_info:
+          mode: 0644
+    formats:
+    - apk
+    - deb
+    - rpm
+    - archlinux
+    dependencies:
+    - git
+    recommends:
+    - golang
+    deb:
+      lintian_overrides:
+        - statically-linked-binary
+        - changelog-file-missing-in-native-package
+
+snapcrafts:
+  - name_template: '{{ .ProjectName }}_{{ .Arch }}{{ if .Arm }}v{{ .Arm }}{{ end }}'
+    summary: Deliver Go binaries as fast and easily as possible
+    description: |
+      GoReleaser builds Go binaries for several platforms, creates a GitHub
+      release and then pushes a Homebrew formula to a repository. All that
+      wrapped in your favorite CI.
+    grade: stable
+    confinement: classic
+    publish: true
+
+sboms:
+  - artifacts: archive
+
+signs:
+- cmd: cosign
+  certificate: '${artifact}.pem'
+  output: true
+  artifacts: checksum
+  args:
+    - sign-blob
+    - '--output-certificate=${certificate}'
+    - '--output-signature=${signature}'
+    - '${artifact}'
+    - --yes
+
+docker_signs:
+- cmd: cosign
+  artifacts: manifests
+  output: true
+  args:
+  - 'sign'
+  - '${artifact}@${digest}'
+  - --yes
+
+publishers:
+  - name: fury.io
+    ids:
+    - packages
+    env:
+    - 'FURY_TOKEN={{ .Env.FURY_TOKEN }}'
+    cmd: ./scripts/fury-upload.sh {{ .ArtifactName }}
+
+milestones:
+  - close: true
+
+release:
+  footer: |
+    **Full Changelog**: https://github.com/goreleaser/goreleaser/compare/{{ .PreviousTag }}...{{ .Tag }}
+
+    * * *
+
+    <a href="https://goreleaser.com"><img src="https://raw.githubusercontent.com/goreleaser/artwork/master/opencollective-header.png" with="100%" alt="GoReleaser logo"></a>
+
+    Find examples and commented usage of all options in our [website](https://goreleaser.com/intro/).
+    Want to help? You can [sponsor](https://goreleaser.com/sponsors/),get a [Pro License](https://goreleaser.com/pro) or [contribute](https://goreleaser.com/contributing).
+    Also, feel free to reach out on [Discord](https://discord.gg/RGEBtg8vQ6) and [Twitter](https://twitter.com/goreleaser)!
+
+announce:
+  twitter:
+    enabled: false
+    message_template: 'GoReleaser {{ .Tag }} is out! Check it out: https://github.com/goreleaser/goreleaser/releases/tag/{{ .Tag }}'
+
+  mastodon:
+    enabled: true
+    message_template: '#GoReleaser {{ .Tag }} is out! Check it out: https://github.com/goreleaser/goreleaser/releases/tag/{{ .Tag }}'
+    server: https://fosstodon.org
+
+  discord:
+    enabled: true
+    message_template: 'GoReleaser {{ .Tag }} is out! Check it out: https://github.com/goreleaser/goreleaser/releases/tag/{{ .Tag }}'
+
+
+# yaml-language-server: $schema=https://goreleaser.com/static/schema.json
+# vim: set ts=2 sw=2 tw=0 fo=jcroql
+

__tests__/goreleaser.test.ts

@@ -1,23 +1,23 @@
 import {describe, expect, it} from '@jest/globals';
 import * as fs from 'fs';
+import * as path from 'path';
 import * as goreleaser from '../src/goreleaser';
 
+const fixturesDir = path.join(__dirname, 'fixtures');
+
 describe('install', () => {
   it('acquires v0.182.0 version of GoReleaser', async () => {
     const bin = await goreleaser.install('goreleaser', 'v0.182.0');
     expect(fs.existsSync(bin)).toBe(true);
   }, 100000);
-
   it('acquires latest version of GoReleaser', async () => {
     const bin = await goreleaser.install('goreleaser', 'latest');
     expect(fs.existsSync(bin)).toBe(true);
   }, 100000);
-
   it('acquires v0.182.0-pro version of GoReleaser Pro', async () => {
     const bin = await goreleaser.install('goreleaser-pro', 'v0.182.0-pro');
     expect(fs.existsSync(bin)).toBe(true);
   }, 100000);
-
   it('acquires latest version of GoReleaser Pro', async () => {
     const bin = await goreleaser.install('goreleaser-pro', 'latest');
     expect(fs.existsSync(bin)).toBe(true);
@@ -28,8 +28,22 @@ describe('distribSuffix', () => {
   it('suffixes pro distribution', async () => {
     expect(goreleaser.distribSuffix('goreleaser-pro')).toEqual('-pro');
   });
-
   it('does not suffix oss distribution', async () => {
     expect(goreleaser.distribSuffix('goreleaser')).toEqual('');
   });
 });
+
+describe('getDistPath', () => {
+  it('none', async () => {
+    expect(await goreleaser.getDistPath(path.join(fixturesDir, 'goreleaser-nodist.yaml'))).toEqual('dist');
+  });
+  it('set', async () => {
+    expect(await goreleaser.getDistPath(path.join(fixturesDir, 'goreleaser-dist.yaml'))).toEqual('/bar');
+  });
+  it('anchors', async () => {
+    expect(await goreleaser.getDistPath(path.join(fixturesDir, 'goreleaser-anchors.yml'))).toEqual('/foo');
+  });
+  it('invalid', async () => {
+    await expect(goreleaser.getDistPath(path.join(fixturesDir, 'goreleaser-invalid.yaml'))).rejects.toThrow();
+  });
+});

package.json

@@ -25,8 +25,8 @@
     "@actions/exec": "^1.1.1",
     "@actions/http-client": "^2.1.0",
     "@actions/tool-cache": "^2.0.1",
-    "js-yaml": "^4.1.0",
     "semver": "^7.5.0",
+    "yaml": "^2.2.2",
     "yargs": "^17.7.2"
   },
   "devDependencies": {

src/goreleaser.ts

@@ -1,7 +1,7 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import * as util from 'util';
-import yaml from 'js-yaml';
+import * as yaml from 'yaml';
 import * as context from './context';
 import * as github from './github';
 import * as core from '@actions/core';
@@ -85,8 +85,13 @@ const getFilename = (distribution: string): string => {
 };
 
 export async function getDistPath(yamlfile: string): Promise<string> {
-  const cfg = yaml.load(fs.readFileSync(yamlfile, 'utf8'));
+  const doc = yaml.parseDocument(fs.readFileSync(yamlfile, 'utf8'), {
-  return cfg.dist || 'dist';
+    prettyErrors: true
+  });
+  if (doc.errors.length > 0) {
+    throw new Error(doc.errors.join('\n'));
+  }
+  return doc.toJSON().dist || 'dist';
 }
 
 export async function getArtifacts(distpath: string): Promise<string | undefined> {

yarn.lock

@@ -2911,13 +2911,13 @@ __metadata:
     eslint-plugin-jest: ^27.2.1
     eslint-plugin-prettier: ^4.2.1
     jest: ^29.5.0
-    js-yaml: ^4.1.0
     prettier: ^2.8.8
     semver: ^7.5.0
     tmp: ^0.2.1
     ts-jest: ^29.1.0
     ts-node: ^10.9.1
     typescript: ^4.9.5
+    yaml: ^2.2.2
     yargs: ^17.7.2
   languageName: unknown
   linkType: soft
@@ -5183,6 +5183,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"yaml@npm:^2.2.2":
+  version: 2.2.2
+  resolution: "yaml@npm:2.2.2"
+  checksum: d90c235e099e30094dcff61ba3350437aef53325db4a6bcd04ca96e1bfe7e348b191f6a7a52b5211e2dbc4eeedb22a00b291527da030de7c189728ef3f2b4eb3
+  languageName: node
+  linkType: hard
+
 "yargs-parser@npm:^21.0.1, yargs-parser@npm:^21.1.1":
   version: 21.1.1
   resolution: "yargs-parser@npm:21.1.1"