fix: replace yaml.v2 to yaml.v3

pkg/config-reader/reader.go

@@ -11,21 +11,23 @@ import (
 	"github.com/aquaproj/aqua/pkg/config"
 	"github.com/aquaproj/aqua/pkg/config/aqua"
 	"github.com/aquaproj/aqua/pkg/util"
+	"github.com/aquaproj/aqua/pkg/yaml"
 	"github.com/spf13/afero"
-	"gopkg.in/yaml.v2"
 )
 
 var errHomeDirEmpty = errors.New("failed to get a user home directory")
 
 type ConfigReaderImpl struct {
-	fs      afero.Fs
-	homeDir string
+	fs          afero.Fs
+	homeDir     string
+	yamlDecoder *yaml.Decoder
 }
 
 func New(fs afero.Fs, param *config.Param) *ConfigReaderImpl {
 	return &ConfigReaderImpl{
-		fs:      fs,
-		homeDir: param.HomeDir,
+		fs:          fs,
+		homeDir:     param.HomeDir,
+		yamlDecoder: yaml.NewDecoder(fs),
 	}
 }
 
@@ -46,12 +48,7 @@ func (reader *MockConfigReader) Read(configFilePath string, cfg *aqua.Config) er
 const homePrefix = "$HOME" + string(os.PathSeparator)
 
 func (reader *ConfigReaderImpl) Read(configFilePath string, cfg *aqua.Config) error {
-	file, err := reader.fs.Open(configFilePath)
-	if err != nil {
-		return err //nolint:wrapcheck
-	}
-	defer file.Close()
-	if err := yaml.NewDecoder(file).Decode(cfg); err != nil {
+	if err := reader.yamlDecoder.ReadFile(configFilePath, cfg); err != nil {
 		return fmt.Errorf("parse a configuration file as YAML %s: %w", configFilePath, err)
 	}
 	var configFileDir string

pkg/config/aqua/config_test.go

@@ -4,8 +4,8 @@ import (
 	"testing"
 
 	"github.com/aquaproj/aqua/pkg/config/aqua"
+	"github.com/aquaproj/aqua/pkg/yaml"
 	"github.com/google/go-cmp/cmp"
-	"gopkg.in/yaml.v2"
 )
 
 func TestConfig_UnmarshalYAML(t *testing.T) { //nolint:funlen

pkg/config/registry/registry_test.go

@@ -10,7 +10,8 @@ import (
 	"testing"
 
 	"github.com/aquaproj/aqua/pkg/config/registry"
-	"gopkg.in/yaml.v2"
+	"github.com/aquaproj/aqua/pkg/yaml"
+	"github.com/spf13/afero"
 )
 
 func downloadTestFile(uri, tempDir string) (string, error) {
@@ -44,16 +45,12 @@ func BenchmarkReadRegistry(b *testing.B) {
 		if err != nil {
 			b.Fatal(err)
 		}
+		yamlDecoder := yaml.NewDecoder(afero.NewOsFs())
 		b.ResetTimer()
 		for i := 0; i < b.N; i++ {
 			func() {
-				f, err := os.Open(registryYAML)
-				if err != nil {
-					b.Fatal(err)
-				}
-				defer f.Close()
 				registry := &registry.Config{}
-				if err := yaml.NewDecoder(f).Decode(registry); err != nil {
+				if err := yamlDecoder.ReadFile(registryYAML, registry); err != nil {
 					b.Fatal(err)
 				}
 			}()

pkg/controller/generate/output/output.go

@@ -7,7 +7,7 @@ import (
 	"github.com/aquaproj/aqua/pkg/config/aqua"
 	goccyYAML "github.com/goccy/go-yaml"
 	"github.com/spf13/afero"
-	"gopkg.in/yaml.v2"
+	"gopkg.in/yaml.v3"
 )
 
 type Outputter struct {

pkg/install-registry/install.go

@@ -17,10 +17,10 @@ import (
 	"github.com/aquaproj/aqua/pkg/domain"
 	"github.com/aquaproj/aqua/pkg/runtime"
 	"github.com/aquaproj/aqua/pkg/slsa"
+	"github.com/aquaproj/aqua/pkg/yaml"
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/afero"
 	"github.com/suzuki-shunsuke/logrus-error/logerr"
-	"gopkg.in/yaml.v2"
 )
 
 type InstallerImpl struct {
@@ -30,6 +30,7 @@ type InstallerImpl struct {
 	cosign             cosign.Verifier
 	slsaVerifier       slsa.Verifier
 	rt                 *runtime.Runtime
+	yamlDecoder        *yaml.Decoder
 }
 
 func New(param *config.Param, downloader domain.GitHubContentFileDownloader, fs afero.Fs, rt *runtime.Runtime, cos cosign.Verifier, slsaVerifier slsa.Verifier) *InstallerImpl {
@@ -40,6 +41,7 @@ func New(param *config.Param, downloader domain.GitHubContentFileDownloader, fs
 		rt:                 rt,
 		cosign:             cos,
 		slsaVerifier:       slsaVerifier,
+		yamlDecoder:        yaml.NewDecoder(fs),
 	}
 }
 
@@ -107,18 +109,18 @@ func (inst *InstallerImpl) InstallRegistries(ctx context.Context, logE *logrus.E
 }
 
 func (inst *InstallerImpl) readRegistry(p string, registry *registry.Config) error {
-	f, err := inst.fs.Open(p)
-	if err != nil {
-		return fmt.Errorf("open the registry configuration file: %w", err)
-	}
-	defer f.Close()
 	if filepath.Ext(p) == ".json" {
+		f, err := inst.fs.Open(p)
+		if err != nil {
+			return fmt.Errorf("open the registry configuration file: %w", err)
+		}
+		defer f.Close()
 		if err := json.NewDecoder(f).Decode(registry); err != nil {
 			return fmt.Errorf("parse the registry configuration as JSON: %w", err)
 		}
 		return nil
 	}
-	if err := yaml.NewDecoder(f).Decode(registry); err != nil {
+	if err := inst.yamlDecoder.ReadFile(p, registry); err != nil {
 		return fmt.Errorf("parse the registry configuration as YAML: %w", err)
 	}
 	return nil

pkg/policy/config_reader.go

@@ -4,17 +4,19 @@ import (
 	"fmt"
 	"path/filepath"
 
+	"github.com/aquaproj/aqua/pkg/yaml"
 	"github.com/spf13/afero"
-	"gopkg.in/yaml.v2"
 )
 
 type ConfigReaderImpl struct {
-	fs afero.Fs
+	fs      afero.Fs
+	decoder *yaml.Decoder
 }
 
 func NewConfigReader(fs afero.Fs) *ConfigReaderImpl {
 	return &ConfigReaderImpl{
-		fs: fs,
+		fs:      fs,
+		decoder: yaml.NewDecoder(fs),
 	}
 }
 
@@ -39,21 +41,16 @@ func (reader *ConfigReaderImpl) Read(files []string) ([]*Config, error) {
 			YAML: &ConfigYAML{},
 		}
 		if err := reader.read(policyCfg); err != nil {
-			return nil, fmt.Errorf("read the policy config file: %w", err)
+			return nil, fmt.Errorf("read a policy file: %w", err)
 		}
 		policyCfgs[i] = policyCfg
 	}
 	return policyCfgs, nil
 }
 
 func (reader *ConfigReaderImpl) read(cfg *Config) error {
-	file, err := reader.fs.Open(cfg.Path)
-	if err != nil {
-		return err //nolint:wrapcheck
-	}
-	defer file.Close()
-	if err := yaml.NewDecoder(file).Decode(cfg.YAML); err != nil {
-		return fmt.Errorf("parse a configuration file as YAML %s: %w", cfg.Path, err)
+	if err := reader.decoder.ReadFile(cfg.Path, cfg.YAML); err != nil {
+		return fmt.Errorf("parse a policy file as YAML: %w", err)
 	}
 	if err := cfg.Init(); err != nil {
 		return err

pkg/yaml/decode.go

@@ -0,0 +1,56 @@
+package yaml
+
+import (
+	"fmt"
+
+	"github.com/spf13/afero"
+	yamlV2 "gopkg.in/yaml.v2"
+	"gopkg.in/yaml.v3"
+)
+
+type Decoder struct {
+	fs afero.Fs
+}
+
+func NewDecoder(fs afero.Fs) *Decoder {
+	return &Decoder{
+		fs: fs,
+	}
+}
+
+// gopkg.in/yaml.v3 can't parse YAML which has duplicated keys, but aqua should allow invalid YAML as much as possible.
+// So aqua uses gopkg.in/yaml.v3 mainly and uses gopkg.in/yaml.v2 only when gopkg.in/yaml.v3 can't parse YAML.
+
+func (decoder *Decoder) ReadFile(p string, dest interface{}) error {
+	fileV3, err := decoder.fs.Open(p)
+	if err != nil {
+		return fmt.Errorf("open a YAML file: %w", err)
+	}
+	defer fileV3.Close()
+	errV3 := yaml.NewDecoder(fileV3).Decode(dest)
+	if errV3 == nil {
+		return nil
+	}
+
+	fileV2, err := decoder.fs.Open(p)
+	if err != nil {
+		return fmt.Errorf("open a YAML file: %w", err)
+	}
+	defer fileV2.Close()
+
+	if err := yamlV2.NewDecoder(fileV2).Decode(dest); err == nil {
+		return nil
+	}
+	return fmt.Errorf("parse a YAML file: %w", errV3)
+}
+
+func Unmarshal(b []byte, dest interface{}) error {
+	errV3 := yaml.Unmarshal(b, dest)
+	if errV3 == nil {
+		return nil
+	}
+	if err := yamlV2.Unmarshal(b, dest); err == nil {
+		return nil
+	}
+	return errV3 //nolint:wrapcheck
+}