refactor: drop serde_yaml by migrating to toml

[jpoehnelt]

Translates the internal AI skill registry files (personas and recipes) from YAML to TOML. This completely eliminates the unmaintained serde_yaml dependency (which was failing supply chain audits) since toml is actively maintained and handles the static config generation perfectly.

[changeset-bot]

🦋 Changeset detected

Latest commit: 9521fca

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@googleworkspace/cli	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[codecov]

Codecov Report

❌ Patch coverage is 33.33333% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 70.86%. Comparing base (f4ee658) to head (9521fca).
⚠️ Report is 6 commits behind head on main.

Files with missing lines	Patch %	Lines
crates/google-workspace-cli/src/generate_skills.rs	33.33%	4 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #657      +/-   ##
==========================================
+ Coverage   70.84%   70.86%   +0.02%     
==========================================
  Files          44       44              
  Lines       20646    20644       -2     
==========================================
+ Hits        14627    14630       +3     
+ Misses       6019     6014       -5     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[codecov]

Codecov Report

❌ Patch coverage is 33.33333% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 70.86%. Comparing base (f4ee658) to head (9521fca).
⚠️ Report is 8 commits behind head on main.

Files with missing lines	Patch %	Lines
crates/google-workspace-cli/src/generate_skills.rs	33.33%	4 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #657      +/-   ##
==========================================
+ Coverage   70.84%   70.86%   +0.02%     
==========================================
  Files          44       44              
  Lines       20646    20644       -2     
==========================================
+ Hits        14627    14630       +3     
+ Misses       6019     6014       -5     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request migrates the project's internal AI skill registry from YAML to TOML. The primary motivation for this change is to eliminate the unmaintained serde_yaml dependency, which was flagged during supply chain audits, and replace it with the actively maintained toml crate. This change includes updating the registry files and the corresponding parsing logic in the CLI tool.

Highlights

• Dependency Management: Removed the unmaintained serde_yaml dependency and added toml to improve supply chain security.
• Registry Migration: Migrated internal AI skill registry files (personas and recipes) from YAML to TOML format.
• Codebase Update: Updated the generate_skills module to parse TOML files instead of YAML, ensuring compatibility with the new registry format.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Footnotes

1. Review the Generative AI Prohibited Use Policy, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request migrates the internal AI skills registry, including personas and recipes, from YAML to TOML format. This change enables the removal of the unmaintained serde_yaml dependency, enhancing the project's security posture. Review feedback identifies a need to correct newline escaping in recipes.toml to ensure proper markdown formatting in generated outputs and suggests improving error reporting in generate_skills.rs by capturing and displaying TOML parsing errors instead of swallowing them.

[gemini-code-assist]

Inconsistent newline escaping in recipe steps. In TOML double-quoted strings, \n (single backslash) is interpreted as a literal newline character. This causes the generated SKILL.md to have broken markdown list formatting because the newline is not indented. To represent a literal \n sequence for the CLI command, use \\n (double backslash), as correctly done on line 226. This issue also affects lines 446 and 494.

  "Add content: gws docs +write --document-id NEW_DOC_ID --text '## Project: Q2 Launch\\n\\n### Objective\\nLaunch the new feature by end of Q2.'",

[gemini-code-assist]

The error message from the TOML parser is swallowed here, which makes it difficult to diagnose syntax errors in the personas.toml file. It is recommended to capture and print the error (e.g., by using a match statement or checking the Err variant). This also applies to the recipes parsing logic at line 262.