fix: disable osv-scanner Go call analysis to prevent OOM kills (#457)

osv-scanner runs govulncheck based Go call analysis by default. That step type
checks the whole build graph and requires more than 8GB of memory on moderately
sized modules, which gets the scan OOM killed with exit code 137.

Measured with osv-scanner v2.5.1 against a 346 package go.mod:

  osv-scanner --lockfile go.mod                        7.6GB  105s
  osv-scanner --no-call-analysis=go --lockfile go.mod   73MB    1.9s

The reported vulnerabilities are identical with and without call analysis, as it
only adds reachability annotations that this action does not act on.

Set OSV_SCANNER_CALL_ANALYSIS to true to re-enable it.

Closes #456

Co-authored-by: Ergin Akin <eakin@scubergphilis.com>

Author: ergousha

build/task.yml

@@ -72,6 +72,10 @@ vars:
   OSV_SCANNER_VERSION_WITHOUT_V_PREFIX: # the version found by the package-version-updater contains a 'v' prefix
     sh: echo {{.OSV_SCANNER_VERSION}} | sed -e "s|v||"
   OSV_SCANNER_BIN: "{{.GOBIN}}/osv-scanner"
+  OSV_SCANNER_CALL_ANALYSIS: '{{.OSV_SCANNER_CALL_ANALYSIS | default "false"}}'
+  # govulncheck based Go call analysis type checks the whole build graph and can
+  # consume more than 8GB, causing the scan to be OOM killed (exit code 137).
+  OSV_SCANNER_CALL_ANALYSIS_FLAG: '{{if eq .OSV_SCANNER_CALL_ANALYSIS "true"}}--call-analysis=go{{else}}--no-call-analysis=go{{end}}'
   OSV_SCANNER_OUTPUT: /tmp/osv-scanner.txt
   GQLGEN_VERSION: v0.17.94
   GQLGEN_BIN: "{{.GOBIN}}/gqlgen"
@@ -375,6 +379,7 @@ tasks:
         echo "Running osv-scanner scan..."
         # Run osv-scanner and capture output, allow it to fail
         {{.OSV_SCANNER_BIN}} \
+          {{.OSV_SCANNER_CALL_ANALYSIS_FLAG}} \
           --lockfile go.mod \
           > {{.OSV_SCANNER_OUTPUT}} 2>&1 || scan_exit_code=$?
 
@@ -398,6 +403,7 @@ tasks:
           echo "Found osv-scanner.toml configuration file."
           echo "Re-running scan with ignore configuration..."
           {{.OSV_SCANNER_BIN}} \
+            {{.OSV_SCANNER_CALL_ANALYSIS_FLAG}} \
             --config osv-scanner.toml \
             --lockfile go.mod \
             > {{.OSV_SCANNER_OUTPUT}} 2>&1 || final_exit_code=$?

docs/osv-scanner.md

@@ -39,6 +39,29 @@ reason = "False positive - not applicable to our usage"
 - Review and update the ignore list regularly
 - Ignored vulnerabilities should be temporary - aim to fix or update dependencies
 
+## Call Analysis
+
+By default osv-scanner runs govulncheck based Go call analysis, which type checks
+the whole build graph. On larger modules this requires more than 8GB of memory and
+the process is OOM killed by the runner (exit code 137, output ends with
+`Killed`). As the reported vulnerabilities are identical with and without it,
+call analysis is disabled in this action.
+
+Set `OSV_SCANNER_CALL_ANALYSIS` to `true` to re-enable it, and make sure enough
+memory is available:
+
+```yaml
+jobs:
+  mcvs-golang-action:
+    runs-on: ubuntu-24.04
+    env:
+      OSV_SCANNER_CALL_ANALYSIS: "true"
+    steps:
+      - uses: schubergphilis/mcvs-golang-action@vX.Y.Z
+        with:
+          testing-type: security-golang-modules
+```
+
 ## Additional Resources
 
 - [osv-scanner GitHub Repository](https://github.com/google/osv-scanner)