Parse ossutil inventory output safely

.github/workflows/mirror-oss.yml

@@ -331,9 +331,23 @@ jobs:
           RELEASE_TAG='${{ steps.release.outputs.tag }}' python - <<'PY'
           import json
           import os
+          import re
           from pathlib import Path
 
-          value = json.loads(Path("oss-inventory.json").read_text(encoding="utf-8"))
+          def load_ossutil_json(path: str) -> object:
+              raw = Path(path).read_text(encoding="utf-8")
+              document = raw.lstrip("\ufeff \t\r\n")
+              if not document.startswith(("{", "[")):
+                  raise ValueError(
+                      "ossutil output does not start with a JSON object or array"
+                  )
+              value, end = json.JSONDecoder().raw_decode(document)
+              trailing = document[end:].strip()
+              if trailing and not re.fullmatch(r"\d+(?:\.\d+)?\(s\) elapsed", trailing):
+                  raise ValueError("unexpected output after ossutil JSON document")
+              return value
+
+          value = load_ossutil_json("oss-inventory.json")
           expected = {
               f"runtime-packs/{os.environ['RELEASE_TAG']}/{path.name}"
               for path in Path("release-dist").iterdir()

tests/test_workflow_contract.py

@@ -74,8 +74,8 @@ def test_oss_workflow_has_no_moving_alias_and_uses_reviewed_shared_bucket() -> N
     assert "oss-version-ids.json" in workflow
     assert 'active != {"enabled"}' in workflow
     assert "load_ossutil_json" in workflow
-    assert workflow.count("JSONDecoder().raw_decode") == 2
-    assert workflow.count("unexpected output after ossutil JSON document") == 2
+    assert workflow.count("JSONDecoder().raw_decode") == 3
+    assert workflow.count("unexpected output after ossutil JSON document") == 3
     assert "candidates = child if isinstance(child, list) else [child]" in workflow