Policy with `--dry-run` flag is overwriting policy

Summary

We control Conjur via Git repositories, I'm looking to build a pre-commit style check to make sure what you're about to push to a PR for review is in fact a valid policy. We have issues sometimes where reviewing a policy looks good, but when it is merged there may be an issue in the policy which then blocks the policy from being loaded. My intention is that these issues can be caught earlier by using --dry-run to validate the intended Conjur policy, but without actually loading it to Conjur. This flag is documented as:

Fully replace an existing policy.

Examples:
- conjur policy replace -b staging -f /policy/staging.yml

Usage:
  conjur policy replace [flags]

Flags:
  -h, --help   help for replace

Global Flags:
  -b, --branch string   The parent policy branch
  -d, --debug           Debug logging enabled
      --dry-run         Dry run mode (input policy will be validated without applying the changes)
  -f, --file string     The policy file to load

When testing this, I've found that even though I have --dry-run on my command line, my policy in Conjur is being affected and replaced.

Steps to Reproduce

Install via Homebrew (cyberark/tools/conjur-cli)
Verify before policy (see screenshots of our internal custom UI)
Create a valid policy file
Run conjur policy replace --dry-run --file policy.yml --branch policy:my/namespace/gchappel-testing/dry-run-load

See that the output confirms dry run mode was used:

Dry run policy 'policy:my/namespace/gchappel-testing/dry-run-load'
{
"status": "",
"errors": null
}

Verify after policy

Expected Results

Since --dry-run was used, the policy should NOT be changed.

Actual Results

The policy was entirely overridden with the file provided on the command line

Reproducible

[x] Always
[ ] Sometimes
[ ] Non-Reproducible

Version/Tag number

Conjur CLI version 8.0.16-6f9eefb

Environment setup

macOS 15
Conjur CLI version as above
Conjur server 13.3.2 (from curl https://conjur.company.com/info | jq -r '.release'

Additional Information

Original policy:

- !policy
  id: before-dry-run
  body:

Before screenshot: Before

New policy:

- !policy
  id: after-dry-run
  body:

After screenshot: After

CLI demonstration:

$ conjur list
[
  "company:policy:my/namespace/gchappel-testing/dry-run-load",
  "company:policy:my/namespace/gchappel-testing/dry-run-load/old",
  "company:variable:my/namespace/gchappel-testing/dry-run-load/test-variable"
]

$ cat after.yml
- !policy
  id: new
  body:

$ conjur policy replace --dry-run --file after.yml --branch my/namespace/gchappel-testing/dry-run-load
Dry run policy 'my/namespace/gchappel-testing/dry-run-load'
{
  "status": "",
  "errors": null
}

$ conjur list
[
  "company:policy:my/namespace/gchappel-testing/dry-run-load",
  "company:policy:my/namespace/gchappel-testing/dry-run-load/new",
  "company:variable:my/namespace/gchappel-testing/dry-run-load/test-variable"
]

cyberark / conjur-cli-go