Repository navigation
ci(osv-scanner): fix argument list too long error #705
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| # This workflow uses actions that are not certified by GitHub. | |
| # They are provided by a third-party and are governed by | |
| # separate terms of service, privacy policy, and support | |
| # documentation. | |
| # A sample workflow which sets up periodic OSV-Scanner scanning for vulnerabilities, | |
| # in addition to a PR check which fails if new vulnerabilities are introduced. | |
| # | |
| # For more examples and options, including how to ignore specific vulnerabilities, | |
| # see https://google.github.io/osv-scanner/github-action/ | |
| name: "OSV Scanner" | |
| on: | |
| push: | |
| branches: ["main"] | |
| schedule: | |
| - cron: "0 0 * * 0" | |
| workflow_dispatch: | |
| permissions: {} | |
| jobs: | |
| osv-scanner: | |
| permissions: | |
| # Required to upload the SARIF file to the security tab | |
| security-events: write | |
| # Required to read the code | |
| contents: read | |
| # Required to read the code | |
| actions: read | |
| uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@a345acffa64b0eaede81a3d9aae6141214d9c8fc" # v2.6.0 | |
| with: | |
| fail-on-vuln: false | |
| check: | |
| runs-on: ubuntu-latest | |
| needs: osv-scanner | |
| steps: | |
| # The results are read from the uploaded artifact rather than from the | |
| # reusable workflow's job outputs: a large output passed to a step via | |
| # env (or inline) exceeds the kernel's per-string exec limit and the | |
| # runner fails to start bash with "Argument list too long". | |
| - name: Download OSV scan results | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: OSV Scanner SARIF file | |
| path: ${{ runner.temp }}/osv | |
| - name: Check OSV scan results | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| IFS=$'\n\t' | |
| # Each rule in the SARIF report is a vulnerability found by the scan, | |
| # with its worst numeric CVSS score in the security-severity property. | |
| # A jq failure (e.g. missing or malformed report) aborts the step via | |
| # set -e instead of being mistaken for "no vulnerabilities". | |
| count="$(jq ' | |
| [ .runs[].tool.driver.rules[]? | |
| | .properties["security-severity"] // empty | |
| | tonumber | |
| | select(. >= 4.0) ] | |
| | length | |
| ' "${RUNNER_TEMP}/osv/results.sarif")" | |
| if [ "${count}" -gt 0 ]; then | |
| >&2 echo "error: found one or more vulnerabilities with a medium or higher severity (see step 'scan > osv-scanner > Run osv-scanner-reporter' for details)" | |
| exit 1 | |
| fi |