When using osv-scanner-reusable-pr.yml reusable workflow, the "Complete job" step fails with the following error:
Error: Fail to evaluate job outputs Error: The template is not valid. System.InvalidOperationException: Maximum object size exceeded at GitHub.DistributedTask.ObjectTemplating.TemplateEvaluator.Evaluate(DefinitionInfo definition) at GitHub.DistributedTask.ObjectTemplating.TemplateEvaluator.HandleMappingWithAllLooseProperties(DefinitionInfo mappingDefinition, DefinitionInfo keyDefinition, DefinitionInfo valueDefinition, MappingToken mapping) at GitHub.DistributedTask.ObjectTemplating.TemplateEvaluator.Evaluate(DefinitionInfo definition) at GitHub.DistributedTask.ObjectTemplating.TemplateEvaluator.Evaluate(TemplateContext context, String type, TemplateToken template, Int32 removeBytes, Nullable1 fileId, Boolean omitHeader)
Cleaning up orphan processes`
Environment
OSV Scanner Action version: v2.3.8
Workflow used: osv-scanner-reusable-pr.yml
Project type: Java / Maven
Java version: 21
Spring Boot version: 3.3.5
jobs: scan-pr: uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@v2.3.8" permissions: actions: read security-events: write contents: read
Root Cause Analysis
The project uses the following dependencies which pull in a very large transitive dependency tree (300-500+ transitive dependencies):
spring-cloud-gcp-starter v5.8.0
spring-cloud-gcp-starter-storage v5.8.0
apache poi-ooxml v5.4.0
Standard Spring Boot starters (web, data-jpa, actuator, validation)
OSV Scanner resolves and checks all transitive dependencies from pom.xml, generating a scan output JSON that exceeds GitHub's hard 1 MB job output limit, causing the "Complete job" step to fail.
Steps to Reproduce
Create a Maven project with spring-cloud-gcp-starter, spring-cloud-gcp-starter-storage, and apache poi-ooxml dependencies
Use osv-scanner-reusable-pr.yml@v2.3.8 in a PR workflow
Raise a PR
Observe "Complete job" step failing with Maximum object size exceeded
Expected Behavior
The reusable workflow should handle large transitive dependency trees gracefully — either by:
Truncating or paginating job outputs that exceed GitHub's 1 MB limit
Passing large scan results via artifacts instead of job outputs
Providing a config option to limit output size
Actual Behavior
Workflow fails at "Complete job" step with Maximum object size exceeded because the job output generated by OSV Scanner exceeds GitHub's hard 1 MB limit.
Suggested Fix
Instead of passing full scan results as job outputs, the reusable workflow should upload large results as artifacts and pass only a reference (artifact ID or URL) as the job output. This would bypass GitHub's 1 MB job output limit entirely.
`# Instead of:
echo "result=$LARGE_SCAN_JSON" >> $GITHUB_OUTPUT
Use:
echo "$LARGE_SCAN_JSON" > scan-result.json # Upload as artifact and pass artifact ID as output`
When using osv-scanner-reusable-pr.yml reusable workflow, the "Complete job" step fails with the following error:
Error: Fail to evaluate job outputs Error: The template is not valid. System.InvalidOperationException: Maximum object size exceeded at GitHub.DistributedTask.ObjectTemplating.TemplateEvaluator.Evaluate(DefinitionInfo definition) at GitHub.DistributedTask.ObjectTemplating.TemplateEvaluator.HandleMappingWithAllLooseProperties(DefinitionInfo mappingDefinition, DefinitionInfo keyDefinition, DefinitionInfo valueDefinition, MappingToken mapping) at GitHub.DistributedTask.ObjectTemplating.TemplateEvaluator.Evaluate(DefinitionInfo definition) at GitHub.DistributedTask.ObjectTemplating.TemplateEvaluator.Evaluate(TemplateContext context, String type, TemplateToken template, Int32 removeBytes, Nullable1 fileId, Boolean omitHeader)Cleaning up orphan processes`
Environment
OSV Scanner Action version: v2.3.8
Workflow used: osv-scanner-reusable-pr.yml
Project type: Java / Maven
Java version: 21
Spring Boot version: 3.3.5
jobs: scan-pr: uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@v2.3.8" permissions: actions: read security-events: write contents: readRoot Cause Analysis
The project uses the following dependencies which pull in a very large transitive dependency tree (300-500+ transitive dependencies):
spring-cloud-gcp-starter v5.8.0
spring-cloud-gcp-starter-storage v5.8.0
apache poi-ooxml v5.4.0
Standard Spring Boot starters (web, data-jpa, actuator, validation)
OSV Scanner resolves and checks all transitive dependencies from pom.xml, generating a scan output JSON that exceeds GitHub's hard 1 MB job output limit, causing the "Complete job" step to fail.
Steps to Reproduce
Create a Maven project with spring-cloud-gcp-starter, spring-cloud-gcp-starter-storage, and apache poi-ooxml dependencies
Use osv-scanner-reusable-pr.yml@v2.3.8 in a PR workflow
Raise a PR
Observe "Complete job" step failing with Maximum object size exceeded
Expected Behavior
The reusable workflow should handle large transitive dependency trees gracefully — either by:
Truncating or paginating job outputs that exceed GitHub's 1 MB limit
Passing large scan results via artifacts instead of job outputs
Providing a config option to limit output size
Actual Behavior
Workflow fails at "Complete job" step with Maximum object size exceeded because the job output generated by OSV Scanner exceeds GitHub's hard 1 MB limit.
Suggested Fix
Instead of passing full scan results as job outputs, the reusable workflow should upload large results as artifacts and pass only a reference (artifact ID or URL) as the job output. This would bypass GitHub's 1 MB job output limit entirely.
`# Instead of:
echo "result=$LARGE_SCAN_JSON" >> $GITHUB_OUTPUT
Use:
echo "$LARGE_SCAN_JSON" > scan-result.json # Upload as artifact and pass artifact ID as output`