Make the scan results an output of the reusable workflow

[thomasleplus]

Hi,

I am trying to create a workflow that would post-process the results produced by osv-scanner-reusable. It seems relatively easy to put the content of the results.json file in an output variable judging from the documentation. I can create a PR for it but I wanted to check first if others think it's a feature that would makes sense for osv-scanner-action? Or maybe there's already an easy way to access the results from my own workflow steps and I missed it.

Cheers,

Tom

[another-rex]

I think that's reasonable, though I'm not sure if there's any size limitations for output variables, as it could get pretty big.

In the reusable workflow we already output the JSON format, it's just into a file rather than a variable, so it could be as easy as running cat results.json into a variable.

[thomasleplus]

I wondered the same about size limitations. As far as Linux is concerned, there seems to be only a limitation on the total size of all the environment variables and it's pretty large (think megabytes). But GitHub may have its own limitation on individual values, I couldn't find anything in the documentation about that so I guess only tests will tell.

I have written a first draft of the code and there's another potential challenge. To assign a value to an output, the key-value syntax is "name=value" but in our case, the value being JSON, what happenes if it contains an = sign or a "? They might need to be escaped but given that we are talking about bash scripting, how reliable would that escaping be especially against shell injection attacks etc.? An alternative approach would be to use base64 to encode the JSON. That prevents any risks of RCE, but it means consumers would have to decode the value. I think that's an acceptable trade off for security but do you agree?

[thomasleplus]

I've create the PR #100 for review. I am not sure how I can test it however?

[another-rex]

Hmm good point on necessity to escape the JSON, looking at the docs it looks like they also recommend just writing to a file:

could whatever following workflow steps just read from the file being written to disk?

[thomasleplus]

Using a file would be much better but I couldn't find a way to make it work with the way I am using the reusable workflow: I import the workflow and then I have a second workflow depending on the reusable one that is processing the results. I have put a simplified example on the PR. I believe (but correct me if I am wrong) that since they are two separate workflows, they can't simply share file on disk. Maybe I could use the artifact repository to store the file but since these are transient files, it feels like a hack.

At first I tried to append my step at the end the reusable workflow which would allow me to access the files. I tried to create a single workflow where the first step is invoking the reusable workflow and the next step is my post-processing but I got a validation error from GitHub saying: "reusable workflows should be referenced at the top-level jobs.*.uses key, not within steps". I also tried a top-level reusable workflow plus an extra step and that didn't work either. That's why I then moved on to the linked workflows approach.

[thomasleplus]

By any chance, could someone look at PR #100?

Cheers

[cuixq]

@thomasleplus sorry about the delay! we will take a look by next week.