fix(ci): bound the release evidence subprocess capture

[FelixTJDietrich]

Problem

The v0.75.0 release failed during Verify evidence from registry subjects:

errno: -105, code: 'ENOBUFS', syscall: 'spawnSync cosign',
spawnargs: [ 'verify-attestation', '--type', 'spdxjson', ... ]

readJsonFromCommand captures through spawnSync with stdio: "pipe" and Node's default 1 MiB maxBuffer. A cosign verify-attestation envelope carries the whole SPDX SBOM base64-encoded, so the webapp's exceeds that cap.

This fired after the images were already tagged, in one of the two checks that are structurally release-only (the attestation does not exist until cosign attest runs during the release), so no preflight could have caught it.

Fix

maxBuffer set once in the shared command() helper rather than at the call site — every capture in this file reads an SBOM, an attestation or an image index, and none has a useful size limit. A test pins both the wiring and the floor.

The wider class

This is the second time the 1 MiB default has bitten: #1744 had to project gh api release listings to four fields because full bodies overflow it too. Several other scripts capture without a bound — check-package-manager.ts reads git ls-files -z over the whole tree, check-affected.ts reads diff name lists. None is release-critical, so they are not in this PR; they are filed separately so this one can land while a release is waiting on it.

Verification

node --test scripts/verify-release-evidence.test.ts → 8/8. pnpm run format then pnpm run check both pass.

No changeset: verify-changesets scopes SHIPPED_PATHS to server, webapp, docker; this touches scripts/ only.

Summary by CodeRabbit

• Bug Fixes

  • Prevented release evidence verification from failing when subprocess output exceeds Node’s default capture limit.
  • Ensured large SBOMs, attestations, and image indexes are captured without truncation during verification.

• Tests

  • Added coverage confirming subprocess captures use an appropriate buffer size for large outputs.

[github-actions]

Approved automatically: @FelixTJDietrich is listed in the REVIEW_POLICY_MAINTAINERS repository variable, which the repository treats as satisfying the review requirement. See the review policy in docs/contributor/ci-cd.mdx.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: 0bac66fd-06da-46be-ae47-d2cdb8b09858

📥 Commits

Reviewing files that changed from the base of the PR and between 070a0cf and a6f154e.

📒 Files selected for processing (2)

• scripts/verify-release-evidence.test.ts
• scripts/verify-release-evidence.ts

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The release evidence verifier now sets a 256 MiB spawnSync capture limit. Tests read the source and verify the limit uses MiB units and is at least 64 MiB.

Changes

Release evidence capture

Layer / File(s)	Summary
Configure and validate subprocess capture scripts/verify-release-evidence.ts, scripts/verify-release-evidence.test.ts	The command helper sets maxBuffer to CAPTURE_LIMIT_BYTES. Tests verify the constant declaration and its minimum size.
Estimated code review effort: 2 (Simple)	~10 minutes

Merge Risk: ⚪ Minimal · up to a6f15

The change bounds release-evidence subprocess capture to prevent oversized registry evidence from failing verification, with no actionable merge-blocking risk remaining after normal checks and review.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the CI fix for release evidence subprocess capture. It matches the main change that sets a capture buffer limit.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/evidence-capture-buffer

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

📚 Documentation Preview

Preview has been removed (PR closed)

[github-actions]

🧩 Storybook Preview

Preview has been removed (PR closed)