Open stevenh opened 2 months ago
The underlying bug is in krakend-cobra, but keeping this so we can track the dependency update.
The check-plugin apply should be used without running go mod tidy
at the end or you will lose all the dependencies "magic".
Unfortunately pipelines often validate go mod tidy
results in no changes or is even part of a pre commit check, however even if this is not the case new dependencies are often introduced, requiring a go mod tidy
, so you want a permanent fix that doesn't need to be constantly reapplied.
The fix for this has already been merged in the upstream repo https://github.com/krakend/krakend-cobra/pull/28
Keeping this ticket open until there's a new release and the dependency is updated to include the fix which I'm hoping can also include the https://github.com/krakend/krakend-cobra/pull/29 which fully automates of this process too.
Environment info: KrakenD version: 2.3.6 on linux amd64 using docker image
devopsfaith/krakend
Describe the bug If you run
krakend check-plugin -f
to output fixes for incompatible package versions it provides ago get
for each package.These work as expected for
direct
dependencies however forindirect
dependencies the changes are lost whengo mod tidy
is run.For indirect dependencies instead of
go get
they should should bego mod edit -replace <pkg>=<pkg>@<version>
which will pin the indirect dependency ensuring the changes aren't lost by runninggo mod tidy
.It would also be nice if there was a way to apply the changes, instead of having to write shell scripts to parse and run, I would suggest adding additional flag such as
--apply
.