Should the 'deps' field be required?
We've a scenario were our automation is removing a previously bumped go dependency, and this is causing build failures, as 'deps' is a required property when 'replaces' is set. Summarised details below:
--------
Take the following example:
```bash
- uses: go/bump
with:
deps: github.com/mholt/archiver/v3@v3.5.1
replaces: github.com/mholt/archiver/v3=github.com/anchore/archiver/v3@v3.5.2
```
Lets assume that`github.com/mholt/archiver/v3@v3.5.1` is now remediated, and delete the 'deps' line:
```bash
- uses: go/bump
with:
replaces: github.com/mholt/archiver/v3=github.com/anchore/archiver/v3@v3.5.2
```
This results in:
> unable to validate with: required input "deps" for pipeline is missing
1 条评论