disallow uses: with a nested pipeline

Signed-off-by: Jason Hall <jason@chainguard.dev>

pkg/config/config.go

@@ -1526,6 +1526,10 @@ func validatePipelines(ps []Pipeline) error {
 			return fmt.Errorf("pipeline cannot contain both uses %q and runs", p.Uses)
 		}
 
+		if p.Uses != "" && len(p.Pipeline) > 0 {
+			return fmt.Errorf("pipeline cannot contain both uses %q and a pipeline", p.Uses)
+		}
+
 		if len(p.With) > 0 && p.Runs != "" {
 			return fmt.Errorf("pipeline cannot contain both with and runs")
 		}

pkg/config/config_test.go

@@ -407,6 +407,14 @@ func TestValidatePipelines(t *testing.T) {
 			},
 			wantErr: true,
 		},
+
+		{
+			name: "invalid pipeline with both uses and pipeline",
+			p: []Pipeline{
+				{Uses: "deploy", Pipeline: []Pipeline{{Runs: "somescript.sh"}}},
+			},
+			wantErr: true,
+		},
 	}
 
 	for _, tt := range tests {