Merge b6285c5922 into 8e2c9b612d

Bumps golang from `68cb6d6` to `11fd8f7`.

---
updated-dependencies:
- dependency-name: golang
  dependency-version: 1.26.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

.github/workflows/codeql.yml

@@ -44,7 +44,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
+      uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -55,7 +55,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
+      uses: github/codeql-action/autobuild@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -69,4 +69,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
+      uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2

.github/workflows/release.yml

@@ -43,7 +43,7 @@ jobs:
             man.md
 
       - name: Install cosign
-        uses: sigstore/cosign-installer@7e8b541eb2e61bf99390e1afd4be13a184e9ebc5 # v3.10.1
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
 
       - name: Cross compile
         run: |

.github/workflows/scorecard.yml

@@ -73,6 +73,6 @@ jobs:
       # Upload the results to GitHub's code scanning dashboard (optional).
       # Commenting out will disable upload of results to your repo's Code Scanning dashboard
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
+        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
         with:
           sarif_file: results.sarif

Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.26.4@sha256:68cb6d68bed024785b69195b89af7ac7a444f27791435f98647edff595aa0479 AS builder
+FROM golang:1.26.4@sha256:11fd8f7f63db3b6fb198797042ba4c40a4a34dc83325d3328ca3bc4bb7726786 AS builder
 
 WORKDIR /go/src/mikefarah/yq
 
@@ -10,7 +10,7 @@ RUN ./scripts/acceptance.sh
 
 # Choose alpine as a base image to make this useful for CI, as many
 # CI tools expect an interactive shell inside the container
-FROM alpine:3@sha256:5b10f432ef3da1b8d4c7eb6c487f2f5a8f096bc91145e68878dd4a5019afde11 AS production
+FROM alpine:3@sha256:a2d49ea686c2adfe3c992e47dc3b5e7fa6e6b5055609400dc2acaeb241c829f4 AS production
 LABEL maintainer="Mike Farah <mikefarah@users.noreply.github.com>"
 
 COPY --from=builder /go/src/mikefarah/yq/yq /usr/bin/yq

Dockerfile.dev

@@ -1,4 +1,4 @@
-FROM golang:1.26.4@sha256:68cb6d68bed024785b69195b89af7ac7a444f27791435f98647edff595aa0479
+FROM golang:1.26.4@sha256:11fd8f7f63db3b6fb198797042ba4c40a4a34dc83325d3328ca3bc4bb7726786
 
 COPY scripts/devtools.sh /opt/devtools.sh
 

go.mod

@@ -22,7 +22,7 @@ require (
 	go.yaml.in/yaml/v4 v4.0.0-rc.5
 	golang.org/x/mod v0.36.0
 	golang.org/x/net v0.55.0
-	golang.org/x/text v0.37.0
+	golang.org/x/text v0.38.0
 )
 
 require (
@@ -33,9 +33,9 @@ require (
 	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mitchellh/go-wordwrap v1.0.1 // indirect
-	golang.org/x/sync v0.20.0 // indirect
+	golang.org/x/sync v0.21.0 // indirect
 	golang.org/x/sys v0.45.0 // indirect
-	golang.org/x/tools v0.44.0 // indirect
+	golang.org/x/tools v0.45.0 // indirect
 )
 
 go 1.25.0

go.sum

@@ -74,15 +74,15 @@ golang.org/x/mod v0.36.0 h1:JJjpVx6myfUsUdAzZuOSTTmRE0PfZeNWzzvKrP7amb4=
 golang.org/x/mod v0.36.0/go.mod h1:moc6ELqsWcOw5Ef3xVprK5ul/MvtVvkIXLziUOICjUQ=
 golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
 golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
-golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
+golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
-golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
 golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
+golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE=
-golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
+golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4=
-golang.org/x/tools v0.44.0 h1:UP4ajHPIcuMjT1GqzDWRlalUEoY+uzoZKnhOjbIPD2c=
+golang.org/x/tools v0.45.0 h1:18qN3FAooORvApf5XjCXgsuayZOEtXf6JK18I3+ONa8=
-golang.org/x/tools v0.44.0/go.mod h1:KA0AfVErSdxRZIsOVipbv3rQhVXTnlU6UhKxHd1seDI=
+golang.org/x/tools v0.45.0/go.mod h1:LuUGqqaXcXMEFEruIVJVm5mgDD8vww/z/SR1gQ4uE/0=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c h1:dUUwHk2QECo/6vqA44rthZ8ie2QXMNeKRTHCNY2nXvo=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

pkg/yqlib/doc/operators/in.md

@@ -0,0 +1,121 @@
+
+## Check key exists in map using variable binding
+Given a sample.yml file of:
+```yaml
+a: 1
+b: 2
+c: 3
+```
+then
+```bash
+yq '. as $m | "a" | in($m)' sample.yml
+```
+will output
+```yaml
+true
+```
+
+## Check key does not exist in map
+Given a sample.yml file of:
+```yaml
+a: 1
+b: 2
+c: 3
+```
+then
+```bash
+yq '. as $m | "d" | in($m)' sample.yml
+```
+will output
+```yaml
+false
+```
+
+## Check value exists in array
+Given a sample.yml file of:
+```yaml
+- Tool
+- Food
+- Flower
+```
+then
+```bash
+yq '. as $m | "Food" | in($m)' sample.yml
+```
+will output
+```yaml
+true
+```
+
+## Check value does not exist in array
+Given a sample.yml file of:
+```yaml
+- Tool
+- Food
+- Flower
+```
+then
+```bash
+yq '. as $m | "Animal" | in($m)' sample.yml
+```
+will output
+```yaml
+false
+```
+
+## Check in with select on array elements
+Filter items whose type is in the given list
+
+Given a sample.yml file of:
+```yaml
+- item: Pizza
+  type: Food
+- item: Rose
+  type: Flower
+- item: Hammer
+  type: Tool
+```
+then
+```bash
+yq '.[] | select(.type | in(["Tool", "Food"]))' sample.yml
+```
+will output
+```yaml
+item: Pizza
+type: Food
+item: Hammer
+type: Tool
+```
+
+## In with variable binding - found
+Given a sample.yml file of:
+```yaml
+a: 1
+b: 2
+c: 3
+```
+then
+```bash
+yq '. as $m | "b" | in($m)' sample.yml
+```
+will output
+```yaml
+true
+```
+
+## In with variable binding - not found
+Given a sample.yml file of:
+```yaml
+a: 1
+b: 2
+c: 3
+```
+then
+```bash
+yq '. as $m | "z" | in($m)' sample.yml
+```
+will output
+```yaml
+false
+```
+

pkg/yqlib/lexer_participle.go

@@ -102,6 +102,7 @@ var participleYqRules = []*participleYqRule{
 
 	simpleOp("select", selectOpType),
 	simpleOp("has", hasOpType),
+	simpleOp("in", inOpType),
 	simpleOp("unique_?by", uniqueByOpType),
 	simpleOp("unique", uniqueOpType),
 

pkg/yqlib/operation.go

@@ -191,6 +191,7 @@ var recursiveDescentOpType = &operationType{Type: "RECURSIVE_DESCENT", NumArgs:
 
 var selectOpType = &operationType{Type: "SELECT", NumArgs: 1, Precedence: 52, Handler: selectOperator, CheckForPostTraverse: true}
 var hasOpType = &operationType{Type: "HAS", NumArgs: 1, Precedence: 50, Handler: hasOperator}
+var inOpType = &operationType{Type: "IN", NumArgs: 1, Precedence: 50, Handler: inOperator}
 var uniqueOpType = &operationType{Type: "UNIQUE", NumArgs: 0, Precedence: 52, Handler: unique, CheckForPostTraverse: true}
 var uniqueByOpType = &operationType{Type: "UNIQUE_BY", NumArgs: 1, Precedence: 52, Handler: uniqueBy, CheckForPostTraverse: true}
 var groupByOpType = &operationType{Type: "GROUP_BY", NumArgs: 1, Precedence: 52, Handler: groupBy, CheckForPostTraverse: true}

pkg/yqlib/operator_in.go

@@ -0,0 +1,59 @@
+package yqlib
+
+import (
+	"container/list"
+)
+
+func inOperator(d *dataTreeNavigator, context Context, expressionNode *ExpressionNode) (Context, error) {
+
+	log.Debugf("inOperation")
+	var results = list.New()
+
+	rhs, err := d.GetMatchingNodes(context.ReadOnlyClone(), expressionNode.RHS)
+
+	if err != nil {
+		return Context{}, err
+	}
+
+	var collection *CandidateNode
+	if rhs.MatchingNodes.Len() != 0 {
+		collection = rhs.MatchingNodes.Front().Value.(*CandidateNode)
+	} else {
+		// no collection provided, return false for all
+		for el := context.MatchingNodes.Front(); el != nil; el = el.Next() {
+			candidate := el.Value.(*CandidateNode)
+			results.PushBack(createBooleanCandidate(candidate, false))
+		}
+		return context.ChildContext(results), nil
+	}
+
+	for el := context.MatchingNodes.Front(); el != nil; el = el.Next() {
+		candidate := el.Value.(*CandidateNode)
+		isIn := false
+
+		switch collection.Kind {
+		case MappingNode:
+			// Check if candidate value exists as a key in the mapping
+			for index := 0; index < len(collection.Content); index = index + 2 {
+				key := collection.Content[index]
+				if key.Value == candidate.Value {
+					isIn = true
+					break
+				}
+			}
+		case SequenceNode:
+			// Check if candidate value is present in the sequence (value membership)
+			for _, element := range collection.Content {
+				if element.Value == candidate.Value {
+					isIn = true
+					break
+				}
+			}
+		default:
+			isIn = false
+		}
+
+		results.PushBack(createBooleanCandidate(candidate, isIn))
+	}
+	return context.ChildContext(results), nil
+}

pkg/yqlib/operator_in_test.go

@@ -0,0 +1,105 @@
+package yqlib
+
+import (
+	"testing"
+)
+
+var inOperatorScenarios = []expressionScenario{
+	{
+		description: "Check key exists in map using variable binding",
+		document:    "a: 1\nb: 2\nc: 3\n",
+		expression:  `. as $m | "a" | in($m)`,
+		expected: []string{
+			"D0, P[], (!!bool)::true\n",
+		},
+	},
+	{
+		description: "Check key does not exist in map",
+		document:    "a: 1\nb: 2\nc: 3\n",
+		expression:  `. as $m | "d" | in($m)`,
+		expected: []string{
+			"D0, P[], (!!bool)::false\n",
+		},
+	},
+	{
+		description: "Check value exists in array",
+		document:    "- Tool\n- Food\n- Flower\n",
+		expression:  `. as $m | "Food" | in($m)`,
+		expected: []string{
+			"D0, P[], (!!bool)::true\n",
+		},
+	},
+	{
+		description: "Check value does not exist in array",
+		document:    "- Tool\n- Food\n- Flower\n",
+		expression:  `. as $m | "Animal" | in($m)`,
+		expected: []string{
+			"D0, P[], (!!bool)::false\n",
+		},
+	},
+	{
+		description:    "Check in with select on array elements",
+		subdescription: "Filter items whose type is in the given list",
+		document:       "- {item: Pizza, type: Food}\n- {item: Rose, type: Flower}\n- {item: Hammer, type: Tool}\n",
+		expression:     `.[] | select(.type | in(["Tool", "Food"]))`,
+		expected: []string{
+			"D0, P[0], (!!map)::{item: Pizza, type: Food}\n",
+			"D0, P[2], (!!map)::{item: Hammer, type: Tool}\n",
+		},
+	},
+	{
+		description: "In with variable binding - found",
+		document:    "a: 1\nb: 2\nc: 3\n",
+		expression:  `. as $m | "b" | in($m)`,
+		expected: []string{
+			"D0, P[], (!!bool)::true\n",
+		},
+	},
+	{
+		description: "In with variable binding - not found",
+		document:    "a: 1\nb: 2\nc: 3\n",
+		expression:  `. as $m | "z" | in($m)`,
+		expected: []string{
+			"D0, P[], (!!bool)::false\n",
+		},
+	},
+	{
+		skipDoc:    true,
+		document:   "- one\n- two\n- three\n",
+		expression: `. as $m | "one" | in($m)`,
+		expected: []string{
+			"D0, P[], (!!bool)::true\n",
+		},
+	},
+	{
+		skipDoc:    true,
+		document:   "- one\n- two\n- three\n",
+		expression: `. as $m | "five" | in($m)`,
+		expected: []string{
+			"D0, P[], (!!bool)::false\n",
+		},
+	},
+	{
+		skipDoc:    true,
+		document:   "key: value\nother: stuff\n",
+		expression: `. as $m | "key" | in($m)`,
+		expected: []string{
+			"D0, P[], (!!bool)::true\n",
+		},
+	},
+	{
+		skipDoc:    true,
+		document:   "key: value\nother: stuff\n",
+		expression: `. as $m | "missing" | in($m)`,
+		expected: []string{
+			"D0, P[], (!!bool)::false\n",
+		},
+	},
+}
+
+func TestInOperatorScenarios(t *testing.T) {
+	for _, tt := range inOperatorScenarios {
+		testScenario(t, &tt)
+	}
+	documentOperatorScenarios(t, "in", inOperatorScenarios)
+}