-
Notifications
You must be signed in to change notification settings - Fork 99
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Some Settings In External Configuration Overridden By Inline Defaults #706
Comments
@AlexWilson-GIS thank you for the very detailed report. Can you test the Action with the branch
Pull request up here: #722 |
Unfortunately, it appears to still be failing. |
@AlexWilson-GIS thanks for the update, we'll try to go through it this week and see what's up. If possible, please leave the reproduction repo up! |
@AlexWilson-GIS I think I understand what the problem is now: If you take a look at the raw log for your PR, the error you are running into is I created this PR with the same
These are two different issues:
I'm marking this as closed and will be merging the PR/doing a new release in the morning. If you feel we should change the behavior of |
Sounds good, thanks. I will open a new issue to request that. |
The Problem
I discovered that the
warn-only
parameter is not settable in an external configuration file by first seeing it get ignored when set only there, then seeing it honored when it was set inline. I believe that this is the source of the issue:The default value for
warn-only
is set here:dependency-review-action/action.yml
Lines 64 to 67 in 40eb2b8
This means that this parameter, along with every other parameter that has a default value defined in
action.yml
, will have an inline setting when the code is merging configurations. However, the way that they are merged is problematic:dependency-review-action/src/config.ts
Lines 19 to 22 in 40eb2b8
As documented in MDN, whenever two objects are merged using the spread operator, fields in a later object will override fields from an earlier object with the same key. This makes
warn-only
and other settings with default values un-configurable from an external file. This is a problem if you want to distribute one configuration file across PR checks in many repositories, including some owned by others that are subscribing to your settings.Suggested Fixes
false
in order to fix the bug.action.yml
:dependency-review-action/action.yml
Lines 7 to 10 in 40eb2b8
dependency-review-action/action.yml
Lines 56 to 67 in 40eb2b8
...and they are all pulled into the action using functions that denote they are optional:
dependency-review-action/src/config.ts
Lines 44 to 50 in 40eb2b8
The one exception to this is
repo-token
:dependency-review-action/src/dependency-graph.ts
Line 13 in 40eb2b8
...however, tokens shouldn't be hardcoded into config files anyway, so that's not an issue like the others.
The text was updated successfully, but these errors were encountered: