Repository: etcd-io/etcd
File: scripts/update_dep.sh (Shell)

Code before:
set -euo pipefail

source ./scripts/test_lib.sh

if [ "$#" -ne 2 ]; then
    echo "Illegal number of parameters"
    exit 1
fi

mod="$1"
ver="$2"

function print_current_dep_version {
  echo "${mod} version in all go mod files"
  grep --exclude-dir=.git --include=\*.mod -Ri "${mod}" | grep -v sum
  printf "\n\n"
}

function is_fully_indirect {
  print_current_dep_version

  # check if all lines end with "// indirect"
  # if grep found nothing, the error code will be non-zero
  if grep --exclude-dir=.git --include=\*.mod -Ri -q "^.*${mod} v.*// indirect$"; then 
      echo "Fully indirect, we will terminate the script"
      exit 1
  else
      echo "Not fully indirect, we will perform dependency bump"
  fi
}

function update_module {
  run go mod tidy

  deps=$(go list -f '{{if .Version}}{{.Path}},{{.Version}}{{end}}' -m all)
  if [[ "$deps" == *"${mod}"* ]]; then
    if [ -z "${ver}" ]; then
      run go get "${mod}"
    else
      run go get "${mod}@${ver}"
    fi
  fi
}

is_fully_indirect
run_for_modules update_module
print_current_dep_version

# check all dependencies across all go mod files have the same pinned version respectively
PASSES="dep" ./scripts/test.sh


Review comment (suggestion):
Sometimes we still need bump pure indirect dependency, i.e. due to CVE. A couple of approaches:
- raise a question something "XXX is a pure indirect dependency, Are you sure you want to proceed? (y/n):"
- Or we can just print a warning and automatically continue to execute the script. As mentioned in previous comment, it's up to maintainers/contributors whether to bump a pure indirect dependency. If not, then they shouldn't run this script at all.

Code after:
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# Usage:
#    ./scripts/update_dep.sh module version
# or ./scripts/update_dep.sh module (to update to the latest version)
# e.g.
#   ./scripts/update_dep.sh github.com/golang/groupcache
#   ./scripts/update_dep.sh github.com/soheilhy/cmux v0.1.5
#
# Updates version of given dependency in all the modules that depend on the mod.

set -euo pipefail

source ./scripts/test_lib.sh

if [ "$#" -lt 1 ] || [ "$#" -gt 2 ]; then
    log_error "Illegal number of parameters. Usage: $0 module [version]"
    exit 1
fi

mod="$1"
ver="${2:-}"

function print_current_dep_version {
  log_info "${mod} version in all go.mod files:"
  find . -name go.mod -exec grep -H "^\s*${mod}\s" {} + | sed 's|:|\t|' || true
  printf "\n"
}

function is_fully_indirect {
  local result
  result=$(find . -name go.mod -print0 | xargs -0 -I{} /bin/sh -c "cd \$(dirname {}); go list -f \"{{if eq .Path \\\"${mod}\\\"}}{{.Indirect}}{{end}}\" -m all" | sort | uniq)
  [ "$result" = "true" ]
}

function update_module {
  local subdir
  subdir=$(module_subdir)

  # The `go get` command is most effective on dependencies that are explicitly
  # listed as direct requirements in the go.mod file. When updating a purely
  # indirect dependency, `go get` might not update it as expected.
  #
  # To work around this, we temporarily promote the indirect dependency to a
  # direct one in the go.mod file using `go mod edit`. This ensures that
  # `go get` will see and correctly update the module. Subsequent cleanup
  # commands (like `go mod tidy`) will automatically move it back
  # to an indirect dependency, but at the designated updated version.
  #