existing cargo-deny-action jobs with --manifest-path now fail

[eric-seppanen]

I encountered a failure in a CI job this morning:

Run EmbarkStudios/cargo-deny-action@v1
  with:
    rust-version: 1.75.0
    log-level: warn
    command: check licenses bans advisories
    arguments: --manifest-path rust/Cargo.toml
    manifest-path: ./Cargo.toml
/usr/bin/docker run --name ca062eae54cac7991f4f5bb0f8ad0c91706ff9_5807cf --label ca062e (...)  "1.75.0" "" "--log-level" "warn" "--manifest-path" "./Cargo.toml" "--manifest-path rust/Cargo.toml" "check licenses bans advisories" ""
info: profile set to 'minimal'
info: syncing channel updates for '1.75.0-x86_64-unknown-linux-musl'
info: latest update on 2023-12-28, rust version 1.75.0 (82e1608df 2023-12-21)
info: downloading component 'cargo'
info: downloading component 'rust-std'
info: downloading component 'rustc'
info: installing component 'cargo'
info: installing component 'rust-std'
info: installing component 'rustc'
info: default toolchain set to '1.75.0-x86_64-unknown-linux-musl'

  1.75.0-x86_64-unknown-linux-musl installed - rustc 1.75.0 (82e1608df 2023-12-21)

error: the argument '--manifest-path <MANIFEST_PATH>' cannot be used multiple times

Usage: cargo-deny [OPTIONS] <COMMAND>

For more information, try '--help'.

I see that the release notes say:

• Added the manifest-path key as a shorthand for doing arguments: --manifest-path

But it's not clear to me whether that release was intended to break the old usage.

I also (incorrectly?) assumed that by pinning to cargo-deny-action@v1 that I wouldn't experience breaking changes.

To Reproduce

jobs:
  cargo-deny:
    runs-on: ubuntu-22.04
    steps:
    - name: Checkout
      uses: actions/checkout@v3
    - name: cargo deny
      uses: EmbarkStudios/cargo-deny-action@v1
      with:
        rust-version: "1.75.0"
        log-level: warn
        command: check licenses bans advisories
        arguments: --manifest-path rust/Cargo.toml

Expected behavior
I expected cargo-deny-action@v1 to keep working, even though my job uses the old arguments: --manifest-path syntax.

[eric-seppanen]

Also, perhaps the readme should be updated to mention the manifest-path key?

[Jake-Shadle]

The v1 is kept at head, if you want to pin you can pin to either a specific version or commit. It wasn't intended to break anyone so maybe I should treat it as v2 now, sorry about the breakage.

[LukeMathWalker]

Just ran into this—not a big deal, but it would have been faster to fix it had the README mentioned manifest_path as an additional optional argument.