merge-sarif-files/action.yaml

@@ -27,11 +27,15 @@ runs:
         # Parse YAML list: lines like "  - path/to/file" or "- file"
         file_list=$(echo "$files" | sed -n 's/^[[:space:]]*-[[:space:]]*//p' | tr -d '"' | tr -d "'")
 
-        # Collect all runs from all SARIF files (each run as one compact JSON line)
-        runs_json=$(while IFS= read -r file; do
+        # Temp file for merged runs (avoids "Argument list too long" when passing huge JSON via argv)
+        runs_temp=$(mktemp)
+        trap 'rm -f "$runs_temp"' EXIT
+
+        # Collect all runs from all SARIF files into temp file (streaming, no argv size limit)
+        while IFS= read -r file; do
           [ -z "$file" ] && continue
           jq -c '.runs[]?' "$file" 2>/dev/null || true
-        done <<< "$file_list" | jq -s '.')
+        done <<< "$file_list" | jq -s '.' > "$runs_temp"
 
         # Take first file for version/schema, replace .runs with merged array
         first_file=$(echo "$file_list" | head -1)
@@ -39,4 +43,4 @@ runs:
           echo "No input files given."
           exit 1
         fi
-        jq -n --argjson runs "$runs_json" --slurpfile first "$first_file" '$first[0] | .runs = $runs' > "$output_file"
+        jq -n --slurpfile runs "$runs_temp" --slurpfile first "$first_file" '$first[0] | .runs = $runs[0]' > "$output_file"