From aa1e6e50c13feaf67410e461553e52b19fc1ac10 Mon Sep 17 00:00:00 2001
From: Jens <jens@localhost.localdomain>
Date: Thu, 30 Jul 2026 02:25:07 +0200
Subject: [PATCH] Generate release SBOM with Syft

---
 .gitea/workflows/release.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index e4180a4..9ce9962 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -35,7 +35,10 @@ jobs:
             --tag "$image" .
           docker push "$image"
           docker image inspect "$image" --format '{{index .RepoDigests 0}}' > image-digest.txt
-          docker sbom "$image" --format spdx-json > sbom.spdx.json
+          docker run --rm \
+            -v /var/run/docker.sock:/var/run/docker.sock \
+            anchore/syft:v1.33.0 \
+            "docker:$image" -o spdx-json > sbom.spdx.json
           cat > RELEASE_NOTES.md <<EOF
           # VacatureRadar ${version}