fix(rules): see quoted and flow-style uses: in KYAML workflows

[hyperpolymath]

What

PinIntegrity (@uses_regex, pin_integrity.ex:56) and research rules RE001 / RE003 / RE005 read workflows as block-style text. On a KYAML workflow (YAML-POLICY Y-3, the estate base form, e.g. yq -o kyaml) they could not see anything:

Form	Before
uses: "owner/repo@sha", # v1	not a pin site (quote, comma)
{ uses: "owner/repo@sha" },	not a pin site ({ anchor)
step items opened by a bare {	RE001 found no job steps, RE005 no steps, RE003 no quoted actions/cache

The blindness was measured before the fix: on main, 6 of the 10 new KYAML cases fail, and the KYAML PI001 mutant passes unnoticed (4 red on the old regex).

How

• pin_integrity: a tolerant regex. It accepts an optional quote (closed by a backreference), a leading { and a trailing } / ,. The key must still open the line (after indentation and an optional - / {), so a uses: inside a run: string is not a site (decoy test). substitute_denylisted_pins keeps rewriting the original bytes, and the quote and comma survive.
• research_extensions: read_workflow/1 → flow_to_block/1 rewrites KYAML to the equivalent block layout one line for one line: closers become blank lines, key: { drops its opener, - goes on a sequence item's first key, and trailing commas and plain quotes are removed. Finding line numbers therefore still point at the source. The rewrite applies only when the first significant line is a bare {, so block YAML (including its own on: [push] and permissions: {}) passes through byte-identical, and the existing suites confirm it. No new file is added under lib/rules/, so the module count stays at 33.

Tests

• test/kyaml_workflow_test.exs: per rule, a positive, a control and (for pin sites) a run:-string decoy; a single-quoted variant; the block-style control.
• test/rules/pin_integrity_test.exs: a KYAML PI001 mutant, caught at its physical line and then repaired in place.
• Full suite: 1768 tests, 0 failures. The 242 :verisim_data tests are excluded, as always (Known Gaps 3). mix format --check-formatted is clean.

Not in scope (recorded, not fixed here)

RE002, RE004, RE006–RE010 and the composite-action uses: scan (re006, ~r/^\s*-?\s*uses:\s*(\S+)/m) still read raw text. They could adopt read_workflow/1 in a follow-up, each with its own KYAML tests. RE003's uses: actions/cache match is content-wide, so a run: body mentioning it counts. That is pre-existing for block YAML, and unquoting makes it reachable from KYAML too.

🤖 Generated with Claude Code

https://claude.ai/code/session_01W5CoaksP2Bg21HpDCgFgwS

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 6b830a6a-31d9-493b-8864-7db6fb3cbde2

📥 Commits

Reviewing files that changed from the base of the PR and between 51ab649 and d649bee.

📒 Files selected for processing (4)

• lib/rules/pin_integrity.ex
• lib/rules/research_extensions.ex
• test/kyaml_workflow_test.exs
• test/rules/pin_integrity_test.exs

 _____________________________________________________________
< Please stop using global state like it's a communal fridge. >
 -------------------------------------------------------------
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}