Complete RC6 supply chain gates

scripts/generate_container_sbom.sh

@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+TARGET_IMAGE="${1:-geointel-ci:local}"
+OUTPUT="${2:-artifacts/geointel-sbom.spdx.json}"
+SYFT_IMAGE="anchore/syft:v1.44.0@sha256:86fde6445b483d902fe011dd9f68c4987dd94e07da1e9edc004e3c2422650de6"
+
+case "$OUTPUT" in
+  /*|*..*)
+    echo "SBOM output must be a repository-relative path without '..'." >&2
+    exit 1
+    ;;
+esac
+
+docker image inspect "$TARGET_IMAGE" >/dev/null
+mkdir -p "$ROOT/$(dirname "$OUTPUT")"
+docker run --rm \
+  -v /var/run/docker.sock:/var/run/docker.sock \
+  -v "$ROOT:/workspace" \
+  -w /workspace \
+  "$SYFT_IMAGE" \
+  "$TARGET_IMAGE" \
+  -o "spdx-json=$OUTPUT"
+
+test -s "$ROOT/$OUTPUT"
+echo "SBOM written to $OUTPUT"