Better yaml serialization for pubspec.lock

[sigurdm]

Sometimes the content hash is quoted, sometimes not.

We use a quite naive yaml serialization for writing pubspec.lock.

Here is the regex that decides is a string needs to be json-encoded before serializing:

https://github.com/dart-lang/pub/blob/2179b765aa9071386be02d408b3c3caa82af98f5/lib/src/utils.dart#L511

/// The subset of strings that don't need quoting in YAML.
///
/// This pattern does not strictly follow the plain scalar grammar of YAML,
/// which means some strings may be unnecessarily quoted, but it's much simpler.
final _unquotableYamlString = RegExp(r'^[a-zA-Z_-][a-zA-Z_0-9-]*$');

We could consider using yaml_edit to write the pubspec.lock file

[sigurdm]

Looking into the quoting rules, I think there is a bug here.

'true' matches this regexp, but should be quoted in yaml.

That means the following test breaks:

import 'package:test/test.dart';

import 'descriptor.dart';
import 'test_pub.dart';

void main() {
  test('handles package "no"', () async {
    // final server = await servePackages();
    // server.serve('true', '1.0.0');
    await git('pkg', [
      libPubspec('pkg', '1.0.0'),
    ]).create();

    await git('pkg', []).runGit(['branch', '-C', 'true']);

    await appDir(
      dependencies: {
        'pkg': {
          'git': {'url': '../pkg', 'ref': 'true'},
        },
      },
    ).create();
    await pubGet();
    await pubGet();
  });
}

With:

[e] ERR : Failed parsing lock file:
[e]     | 
[e]     | Error on line 7, column 7 of pubspec.lock: The 'ref' field of the description must be a string.
[e]     |    ╷
[e]     | 7  │ ┌       path: "."
[e]     | 8  │ │       ref: true
[e]     | 9  │ │       resolved-ref: c43723560f742af8bf6d7836d3f87fe4fee0681f
[e]     | 10 │ │       url: "../pkg"
[e]     | 11 │ │     source: git
[e]     |    │ └────^
[e]     |    ╵
[e]     | 
[e]     | Consider deleting the file and running `dart pub get` to recreate it.

[sigurdm]

Fixing this for hashes starting with a digit might cause most pubspec.locks to be updated. Not sure it is worth it.