Closed evanweible-wf closed 2 months ago
No security relevant content was detected by automated scans.
aviary.yaml
coverage of security relevant codeQuestions or Comments? Reach out on Slack: #support-infosec.
QA +1
dpx
without using an arg separator@Workiva/release-management-p
I removed the
allowTrailingOptions: false
in a recent PR, only to remember that it was supposed to be disabled. When trailing options are allowed, it becomes impossible to pass options/flags as args to the subcommand thatdpx
runs since the top-leveldpx
arg parser will try to parse them.For example:
This should run
dependency_validator --help
and display the help output for that executable, but it actually displays the help output fordpx
. Similarly, if you tried to use a CLI flag or option of the subcommand,dpx
would fail to parse args altogether.While it's possible to workaround this by using an arg separator...
... it's awkward and unintuitive.
dpx
is supposed to make it as easy to run other package executables, so we should aim to make thedpx
CLI get out of the way whenever possible and favor the underlying package executable.This PR makes that change by disallowing (ignoring) trailing options.
Note: the only real downside is that if you want to make
dpx
run in verbose mode, you have to add the--verbose
flag first, like so:This is a minor inconvenience and an acceptable trade off.