ci(osv-scanner): fix arguments too long

Author: thomasleplus

.github/workflows/osv-scanner-pr.yml

@@ -37,21 +37,20 @@ jobs:
     steps:
       - name: Check OSV scan results
         shell: bash
+        env:
+          # Passed through the environment rather than interpolated into the
+          # script body. The runner injects these out-of-band, so the scanner
+          # JSON can never break out of the surrounding shell context no matter
+          # what it contains or how large it is.
+          NEW_RESULTS: ${{ needs.osv-scanner-pr.outputs.new-results }}
+          OLD_RESULTS: ${{ needs.osv-scanner-pr.outputs.old-results }}
         run: |
           set -euo pipefail
           IFS=$'\n\t'
-          # The scan results JSON can be very large (potentially exceeding the
-          # command-line / ARG_MAX length limit if passed as an argument or as
-          # an env var expanded on the command line), so the workflow-level
-          # expansion is written straight to a file via a quoted heredoc.
-          # The quoted delimiter prevents any runtime shell expansion of
-          # the JSON contents.
-          cat > "${RUNNER_TEMP}/new_results.json" <<'__OSV_NEW_RESULTS_EOF__'
-          ${{ needs.osv-scanner-pr.outputs.new-results }}
-          __OSV_NEW_RESULTS_EOF__
-          cat > "${RUNNER_TEMP}/old_results.json" <<'__OSV_OLD_RESULTS_EOF__'
-          ${{ needs.osv-scanner-pr.outputs.old-results }}
-          __OSV_OLD_RESULTS_EOF__
+          # printf is a bash builtin, so the (potentially very large) values are
+          # written to disk without hitting the ARG_MAX command-line limit.
+          printf '%s' "${NEW_RESULTS}" > "${RUNNER_TEMP}/new_results.json"
+          printf '%s' "${OLD_RESULTS}" > "${RUNNER_TEMP}/old_results.json"
           # Fail if any vulnerability present in the new results is absent from
           # the old results, i.e. the PR introduces it. Read via process
           # substitution rather than a pipe so the rc assignment is not lost in

.github/workflows/osv-scanner.yml

@@ -39,18 +39,18 @@ jobs:
     steps:
       - name: Check OSV scan results
         shell: bash
+        env:
+          # Passed through the environment rather than interpolated into the
+          # script body. The runner injects this out-of-band, so the scanner
+          # JSON can never break out of the surrounding shell context no matter
+          # what it contains or how large it is.
+          RESULTS: ${{ needs.osv-scanner.outputs.results }}
         run: |
           set -euo pipefail
           IFS=$'\n\t'
-          # The scan results JSON can be very large (potentially exceeding the
-          # command-line / ARG_MAX length limit if passed as an argument or as
-          # an env var expanded on the command line), so the workflow-level
-          # expansion is written straight to a file via a quoted heredoc.
-          # The quoted delimiter prevents any runtime shell expansion of
-          # the JSON contents.
-          cat > "${RUNNER_TEMP}/results.json" <<'__OSV_RESULTS_EOF__'
-          ${{ needs.osv-scanner.outputs.results }}
-          __OSV_RESULTS_EOF__
+          # printf is a bash builtin, so the (potentially very large) value is
+          # written to disk without hitting the ARG_MAX command-line limit.
+          printf '%s' "${RESULTS}" > "${RUNNER_TEMP}/results.json"
           # jq expression:
           # - iterate packages -> vulnerabilities -> full osv entry -> severity[] (type, score)
           # - extract numeric scores for CVSS types (cvss_v3 or numeric severity[].score)

.zizmor.yml

@@ -15,7 +15,3 @@ rules:
         - ossf/*
         - sigstore/*
         - super-linter/super-linter
-  template-injection:
-    ignore:
-      - osv-scanner.yml
-      - osv-scanner-pr.yml