gobump - Should the 'deps' field be required?

[mamccorm]

We've a scenario were our automation is removing a previously bumped go dependency, and this is causing build failures, as 'deps' is a required property when 'replaces' is set. Summarised details below:

---

Take the following example:

- uses: go/bump
  with:
    deps: github.com/mholt/archiver/v3@v3.5.1
    replaces: github.com/mholt/archiver/v3=github.com/anchore/archiver/v3@v3.5.2

Lets assume thatgithub.com/mholt/archiver/v3@v3.5.1 is now remediated, and delete the 'deps' line:

- uses: go/bump
  with:
    replaces: github.com/mholt/archiver/v3=github.com/anchore/archiver/v3@v3.5.2

This results in:

unable to validate with: required input "deps" for pipeline is missing

[hectorj2f]

@mamccorm Thanks for opening the issue.