Custom Step Templates have no validation on required fields

[droyad]

Team

• I've assigned a team label to this issue

Severity

Low

Version

For ever?

Latest Version

I could reproduce the problem in the latest version

What happened?

Certain Step inputs are required before a step in a process can be saved.

When creating a Custom Step Template that extends a built-in step, these same "required" rules are not always enforced, compared to if you were using the given Built-In step directly in a deployment process.

The validation to ensure the fields are fill out doesn't run when saving the step template, but do run when adding the step. However they can't be edited then.

https://octopusdeploy.slack.com/archives/C01J6U3MHJ4/p1621831538028800

Reproduction

1. Create a new Custom Step Template, using "Deploy to IIS" as the base step
2. Add a name for the Step Template
3. Change to the "Step" tab and choose any random package under the "package" field, it doesn't matter which
4. Choose "Virtual Directory" as the IIS Deployment Type, but do not fill in "Parent web site" or "Virtual path"
5. Save the Step template

Expected (maybe*): Saving the step template should fail unless all required fields have a value, either something hardcoded, or a value plumbed through from a Step Template Parameter
Actual: Step Template can be saved and used in a deployment process. When used in a process, the validation runs and says that the required fields are missing, however the UI only exposes the Step Template parameters to the user, so they have no way of providing the required values.

Error and Stacktrace

N/A

More Information

No response

Workaround

No response

[mjhilton]

This seems to be the case for all Built-In steps: Custom Step Templates can be saved without any of fields that would otherwise be mandatory when using that Built-In step directly in a process, except for specific common fields such as "Package" and "Account", which have validation enforced.

For anything else specific to the step, saving without values is allowed when editing the Custom Step Template. I tested this across:

• Deploy an AWS CloudFormation Template
  • Can save without Region and StackName, which are mandatory when using directly
• Apply a Terraform Template
  • Can save without AWS Account Variable and Region when "Use AWS Account" is selected, which are mandatory when using directly
• Deploy an Azure Cloud Service (Legacy mode)
  • Can save without Account, Cloud Service and Storage when "Legacy Mode" is selected, which are mandatory when using directly

This makes me suspect that there might have been a historical reason for this decision. I'm unsure whether this is something we should change without knowing the reasoning.

[mjhilton]

This one seems to have existed since Custom Step Templates were introduced, and is potentially even as-designed (as a trade-off to minimise other potential failure scenarios).

We'll need to get some product input on whether or how to fix this. No timeframe for changes right now.