Address Copilot review feedback on PR #748

- Switch upstream-release scripts and the inline node snippet in the
  workflow from `js-yaml` to the already-declared `yaml` package, so
  the workflow does not rely on a transitive dependency that could
  disappear in a future install. Rewrites the `.load()` calls to
  `.parse()` to match the new package's API.
- Filter out null author logins in the `gh api compare` reviewers
  extraction (`.commits[].author.login? // empty`) so a commit with an
  unlinked GitHub user cannot pass an empty value into --add-reviewer.
- Replace the nested `$([ ... ] && ... || ...)` has_gaps expression
  with an explicit `if/else` block so the quoting stays obviously
  correct and resists accidental breakage in future edits.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: rdimitrov

.github/workflows/upstream-release-docs.yml

@@ -270,7 +270,7 @@ jobs:
           # Capture stderr separately so we can surface a missing-compare
           # situation in the PR body rather than silently dropping reviewers.
           if COMPARE=$(gh api "repos/$REPO/compare/$PREV...$NEW" \
-              --jq '[.commits[].author.login] | unique | .[]' 2>/dev/null); then
+              --jq '[.commits[].author.login? // empty] | unique | .[]' 2>/dev/null); then
             REVIEWERS=$(echo "$COMPARE" |
               grep -Ev '(\[bot\]$|^github-actions|^stacklokbot$|^dependabot|^renovate|^copilot)' |
               head -5 | paste -sd, -)
@@ -288,9 +288,9 @@ jobs:
           PROJECT_ID: ${{ steps.detect.outputs.id }}
         run: |
           HINTS=$(node -e "
-            const yaml = require('js-yaml');
+            const yaml = require('yaml');
             const fs = require('fs');
-            const p = yaml.load(fs.readFileSync('.github/upstream-projects.yaml','utf8')).projects.find(x=>x.id===process.env.PROJECT_ID);
+            const p = yaml.parse(fs.readFileSync('.github/upstream-projects.yaml','utf8')).projects.find(x=>x.id===process.env.PROJECT_ID);
             console.log(JSON.stringify(p?.docs_paths ?? []));
           ")
           echo "docs_paths=$HINTS" >> "$GITHUB_OUTPUT"
@@ -388,7 +388,11 @@ jobs:
             fi
             echo "GAPS_EOF"
 
-            echo "has_gaps=$([ -n "$GAPS_BODY" ] && echo true || echo false)"
+            if [ -n "$GAPS_BODY" ]; then
+              echo "has_gaps=true"
+            else
+              echo "has_gaps=false"
+            fi
           } >> "$GITHUB_OUTPUT"
 
       - name: Apply pin_files substitutions

scripts/upstream-release/apply-pin-files.mjs

@@ -15,7 +15,7 @@
 //       so unrelated `@latest` strings elsewhere in the file are safe.
 
 import fs from 'node:fs';
-import yaml from 'js-yaml';
+import yaml from 'yaml';
 
 const PROJECTS_FILE = '.github/upstream-projects.yaml';
 
@@ -66,7 +66,7 @@ function main() {
     process.exit(1);
   }
 
-  const parsed = yaml.load(fs.readFileSync(PROJECTS_FILE, 'utf8'));
+  const parsed = yaml.parse(fs.readFileSync(PROJECTS_FILE, 'utf8'));
   const project = parsed.projects.find((p) => p.id === id);
   if (!project) {
     console.error(`Unknown project id: ${id}`);

scripts/upstream-release/bump-yaml.mjs

@@ -17,7 +17,7 @@
 // matches (no-op — caller should not open a PR).
 
 import fs from 'node:fs';
-import yaml from 'js-yaml';
+import yaml from 'yaml';
 
 const PROJECTS_FILE = '.github/upstream-projects.yaml';
 
@@ -69,7 +69,7 @@ function main() {
   }
 
   const raw = fs.readFileSync(PROJECTS_FILE, 'utf8');
-  const parsed = yaml.load(raw);
+  const parsed = yaml.parse(raw);
   if (!parsed.projects.find((p) => p.id === id)) {
     console.error(`Unknown project id: ${id}`);
     process.exit(1);

scripts/upstream-release/detect-change.mjs

@@ -22,7 +22,7 @@
 
 import { execFileSync } from 'node:child_process';
 import fs from 'node:fs';
-import yaml from 'js-yaml';
+import yaml from 'yaml';
 
 const PROJECTS_FILE = '.github/upstream-projects.yaml';
 const REPO_SHAPE = /^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/;
@@ -41,13 +41,13 @@ function loadFromRef(ref) {
   const text = execFileSync('git', ['show', `${ref}:${PROJECTS_FILE}`], {
     encoding: 'utf8',
   });
-  return yaml.load(text).projects;
+  return yaml.parse(text).projects;
 }
 
 function main() {
   const ref = process.env.BASE_REF || 'origin/main';
   const mainProjects = loadFromRef(ref);
-  const headProjects = yaml.load(
+  const headProjects = yaml.parse(
     fs.readFileSync(PROJECTS_FILE, 'utf8')
   ).projects;