osv-scanner: version line can fail the job with SIGPIPE (exit 141) #10

New issue

Open

opened 2026-11-01 15:55:54 -06:00 by Claude · 0 comments

Claude commented

2026-11-01 15:55:54 -06:00

Member

osv-scanner/action.yml can fail the osv job at random with exit 141 (SIGPIPE), before any scan runs.

What happens

The Install osv-scanner step runs under set -euo pipefail and ends with:

osv-scanner --version | head -1

osv-scanner --version prints more than one line. head -1 prints the first and exits. If osv-scanner writes its next line after head has closed the pipe, it is killed by SIGPIPE (128 + 13 = 141). pipefail makes that the pipeline status and set -e fails the step.

Whether it fails depends on timing, so it is intermittent. Seen on Homelab/infra PR 879 (run 1612, task 10867, action pinned at e7230799). The log shows the checksum line, then osv-scanner version: 2.7.0, then exitcode '141': failure 45 ms later, with no scan output. The same commit passed osv on the re-run (run 1616), and osv passed on the five runs before it.

The line is still on main (b8c53ba, line 41).

Fix

Read all of the output so the writer never meets a closed pipe:

osv-scanner --version | sed -n 1p

or drop the filter and print the whole version output. After the fix lands, repos that pin ci/actions/osv-scanner@<sha> need their pin bumped to get it.

Done when

action.yml no longer pipes --version into an early-exiting reader under pipefail
a test run of the action passes
the pins in the repos that use it are bumped (Homelab/infra at least)

Generated by Aki, acting as Claude

`osv-scanner/action.yml` can fail the `osv` job at random with exit 141 (SIGPIPE), before any scan runs. ## What happens The `Install osv-scanner` step runs under `set -euo pipefail` and ends with: ```bash osv-scanner --version | head -1 ``` `osv-scanner --version` prints more than one line. `head -1` prints the first and exits. If osv-scanner writes its next line after `head` has closed the pipe, it is killed by SIGPIPE (128 + 13 = 141). `pipefail` makes that the pipeline status and `set -e` fails the step. Whether it fails depends on timing, so it is intermittent. Seen on Homelab/infra PR 879 (run 1612, task 10867, action pinned at `e7230799`). The log shows the checksum line, then `osv-scanner version: 2.7.0`, then `exitcode '141': failure` 45 ms later, with no scan output. The same commit passed `osv` on the re-run (run 1616), and `osv` passed on the five runs before it. The line is still on `main` (`b8c53ba`, line 41). ## Fix Read all of the output so the writer never meets a closed pipe: ```bash osv-scanner --version | sed -n 1p ``` or drop the filter and print the whole version output. After the fix lands, repos that pin `ci/actions/osv-scanner@<sha>` need their pin bumped to get it. ## Done when - [ ] `action.yml` no longer pipes `--version` into an early-exiting reader under `pipefail` - [ ] a test run of the action passes - [ ] the pins in the repos that use it are bumped (Homelab/infra at least) _Generated by Aki, acting as Claude_

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

ci/actions#10

No description provided.

Rows
Columns