ci(osv-scanner): fix argument list too long error

Author: thomasleplus

.github/workflows/osv-scanner-pr.yml

@@ -30,39 +30,37 @@ jobs:
       actions: read
     uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@a345acffa64b0eaede81a3d9aae6141214d9c8fc" # v2.6.0
     with:
-      export-results: true
       fail-on-vuln: false
   check:
     runs-on: ubuntu-latest
     needs: osv-scanner-pr
     steps:
+      # The results are read from the uploaded artifacts rather than from the
+      # reusable workflow's job outputs: a large output passed to a step via
+      # env (or inline) exceeds the kernel's per-string exec limit and the
+      # runner fails to start bash with "Argument list too long".
+      - name: Download OSV scan results
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          pattern: "*-json-results"
+          merge-multiple: true
+          path: ${{ runner.temp }}/osv
       - name: Check OSV scan results
         shell: bash
-        env:
-          # Passed through the environment rather than interpolated into the
-          # script body. The runner injects these out-of-band, so the scanner
-          # JSON can never break out of the surrounding shell context no matter
-          # what it contains or how large it is.
-          NEW_RESULTS: ${{ needs.osv-scanner-pr.outputs.new-results }}
-          OLD_RESULTS: ${{ needs.osv-scanner-pr.outputs.old-results }}
         run: |
           set -euo pipefail
           IFS=$'\n\t'
-          # printf is a bash builtin, so the (potentially very large) values are
-          # written to disk without hitting the ARG_MAX command-line limit.
-          printf '%s' "${NEW_RESULTS}" > "${RUNNER_TEMP}/new_results.json"
-          printf '%s' "${OLD_RESULTS}" > "${RUNNER_TEMP}/old_results.json"
           # Fail if any vulnerability present in the new results is absent from
           # the old results, i.e. the PR introduces it. Read via process
           # substitution rather than a pipe so the rc assignment is not lost in
           # a subshell, and use a fixed-string match for the exact vuln id.
           rc=0
           while read -r vid; do
-            if ! grep -qF -e "\"${vid}\"" "${RUNNER_TEMP}/old_results.json"; then
+            if ! grep -qF -e "\"${vid}\"" "${RUNNER_TEMP}/osv/old-results.json"; then
               rc=1
               >&2 echo "error: PR introduces new vulnerability ${vid} (see step 'scan > osv-scanner-pr > Run osv-scanner-reporter' for details)"
             fi
-          done < <(jq -r '.results[]?.packages[]?.vulnerabilities[]?.id' "${RUNNER_TEMP}/new_results.json")
+          done < <(jq -r '.results[]?.packages[]?.vulnerabilities[]?.id' "${RUNNER_TEMP}/osv/new-results.json")
           if [ "${rc}" -ne 0 ]; then
             exit 1
           fi

.github/workflows/osv-scanner.yml

@@ -32,38 +32,37 @@ jobs:
       actions: read
     uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@a345acffa64b0eaede81a3d9aae6141214d9c8fc" # v2.6.0
     with:
-      export-results: true
       fail-on-vuln: false
   check:
     runs-on: ubuntu-latest
     needs: osv-scanner
     steps:
+      # The results are read from the uploaded artifact rather than from the
+      # reusable workflow's job outputs: a large output passed to a step via
+      # env (or inline) exceeds the kernel's per-string exec limit and the
+      # runner fails to start bash with "Argument list too long".
+      - name: Download OSV scan results
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: OSV Scanner SARIF file
+          path: ${{ runner.temp }}/osv
       - name: Check OSV scan results
         shell: bash
-        env:
-          # Passed through the environment rather than interpolated into the
-          # script body. The runner injects this out-of-band, so the scanner
-          # JSON can never break out of the surrounding shell context no matter
-          # what it contains or how large it is.
-          RESULTS: ${{ needs.osv-scanner.outputs.results }}
         run: |
           set -euo pipefail
           IFS=$'\n\t'
-          # printf is a bash builtin, so the (potentially very large) value is
-          # written to disk without hitting the ARG_MAX command-line limit.
-          printf '%s' "${RESULTS}" > "${RUNNER_TEMP}/results.json"
-          # jq expression:
-          # - iterate packages -> vulnerabilities -> full osv entry -> severity[] (type, score)
-          # - extract numeric scores for CVSS types (cvss_v3 or numeric severity[].score)
-          # - compare to threshold
-          if jq '
-            .results[]
-            | .packages[]?
-            | .vulnerabilities[]?
-            | ( .severity[]?.score // "" ) as $s
-            | select($s != "")
-            | ($s | tonumber) >= 4.0
-            ' "${RUNNER_TEMP}/results.json" | grep -q -e . ; then
+          # Each rule in the SARIF report is a vulnerability found by the scan,
+          # with its worst numeric CVSS score in the security-severity property.
+          # A jq failure (e.g. missing or malformed report) aborts the step via
+          # set -e instead of being mistaken for "no vulnerabilities".
+          count="$(jq '
+            [ .runs[].tool.driver.rules[]?
+              | .properties["security-severity"] // empty
+              | tonumber
+              | select(. >= 4.0) ]
+            | length
+            ' "${RUNNER_TEMP}/osv/results.sarif")"
+          if [ "${count}" -gt 0 ]; then
             >&2 echo "error: found one or more vulnerabilities with a medium or higher severity (see step 'scan > osv-scanner > Run osv-scanner-reporter' for details)"
             exit 1
           fi