[josephaxisa]

Fixes oasdiff/oasdiff#1356.

When a block scalar's indentation is auto-detected, a first content line made of the indentation spaces followed by a tab is rejected with "found a tab character where an indentation space is expected". YAML 1.2.2 counts only spaces as indentation, so the tab is content (Example 8.2). A tab inside the parent's indentation is still an error.

This is the same change as yaml/go-yaml@85bfc37, merged in yaml/go-yaml#440. go-yaml v4 counts columns from 1 and parser.indent the same way, so the condition carries over unchanged.

Tests: Example 8.2 and a: |-\n \ttext\n now decode, and both fail without the change. a:\n b: |\n \ttext\n and - |\n\ttext\n still error; they already errored before the change and guard the parent-indentation check.

Checked:

• go test -race ./... passes.
• yaml-test-suite (data branch): no test goes from pass to fail; R4YG, 96NN/00, 96NN/01 and Y79Y/001 now pass. Tab error tests (4EJS, DK95/06, Y79Y/000, 004-009) still error.
• oasdiff v1.33.0's tests pass with this yaml3.
• Loading all 1,970 APIs.guru openapi.yaml files through kin-openapi: the 1,929 that loaded before are unchanged; 31 that failed with this error now load (Adyen Checkout/Payment/Payout, amadeus.com).

Not changed: a top-level block scalar with content at column 0 (|\n\ttext\n) still errors, now with "found character that cannot start any token". yaml3 requires top-level block scalar content to be indented at least one space; that's separate from this fix.

[reuvenharrison]

Reviewed and verified independently, CI is green now too.

• The condition is a faithful port of yaml/go-yaml@85bfc37, same structure, and a tab inside the parent's indentation stays an error.
• With scannerc.go reverted and the tests kept, the two new decode cases fail, so they do pin the fix. Small correction to the description: the two error cases pass either way, since that input already errored before the change. They are useful guards rather than failing-before tests.
• End to end: built oasdiff main against this branch. The spec from Valid YAML rejected: "found a tab character where an indentation space is expected" oasdiff#1356 loads, and the description decodes as "\tStarts with a tab after the indentation.". The APIs.guru Adyen CheckoutService spec (613 KB, version 70) fails on main at line 5727 and loads with this branch.

One thing worth knowing before this gets released: getkin/kin-openapi#1238 replaces the JSON round trip with native YAML decoding and, in doing so, drops oasdiff/yaml3 in favour of go.yaml.in/yaml/v3 v3.0.5. That module still has the unfixed check, so once that lands this fix no longer reaches kin and the bug returns. Its own goldens show it: the Adyen specs still fail there, with only the error wording changed. The upstream commit is on the v4 line and is not in a released RC yet (v4.0.0-rc.6 predates it), and v3.0.5 is the last v3 tag.

So this is worth merging and releasing for the current dependency path, and the durable fix is the same one-line change on the v3 branch of yaml/go-yaml, which is what go.yaml.in/yaml/v3 is built from. That branch is still active and still has the old check, and your commit should transfer nearly as-is since it uses the same decode_test.go layout. Would you want to open that backport upstream, and ask them for a v3.0.6 tag? You have already done the port and checked it against the yaml test suite and APIs.guru, which is most of what such a proposal needs.

[josephaxisa]

Thanks for checking this end to end. And you're right.. the two error cases already errored before the change, so they guard the parent-indentation check rather than pin the fix. I've updated the description.

Good catch on getkin/kin-openapi#1238. I've opened the backport on the v3 branch of yaml/go-yaml, yaml/go-yaml#453. It applies as-is, and go test -race passes. With the scanner change reverted, the two new decode cases fail. Running yaml-test-suite against v3 gives the same result as here: R4YG, 96NN/00, 96NN/01 and Y79Y/001 go from fail to pass, nothing regresses, and the tab error tests still error. I've asked them to tag v3.0.6 once it's merged.

In the meantime it would be great to merge and release this one, so the current dependency path is fixed until kin moves.

[josephaxisa]

Quick update from yaml/go-yaml#453. @ingydotnet reviewed the backport and noted they are focusing on getting v4.0.0 out first before considering any backports to v3. So merging and tagging this here in oasdiff/yaml3 is the right path for oasdiff and kin-openapi in the meantime.