From 07930ec7cb9c2757767ef0b04cacfb386fe96173 Mon Sep 17 00:00:00 2001
From: Jens Caers <jens@itworx.tech>
Date: Wed, 26 Aug 2026 23:53:20 +0200
Subject: [PATCH] ci: make SBOM generation nested-runner safe

---
 scripts/generate_container_sbom.sh | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/scripts/generate_container_sbom.sh b/scripts/generate_container_sbom.sh
index 9285bb2b..806db209 100644
--- a/scripts/generate_container_sbom.sh
+++ b/scripts/generate_container_sbom.sh
@@ -15,13 +15,16 @@ esac
 
 docker image inspect "$TARGET_IMAGE" >/dev/null
 mkdir -p "$ROOT/$(dirname "$OUTPUT")"
+
+# Gitea/act executes jobs inside a container while Docker commands target the
+# host daemon. Host-path binds to $ROOT therefore do not point at the checkout.
+# Stream the SPDX document over stdout instead; only the Docker socket crosses
+# the nested-runner boundary.
 docker run --rm \
   -v /var/run/docker.sock:/var/run/docker.sock \
-  -v "$ROOT:/workspace" \
-  -w /workspace \
   "$SYFT_IMAGE" \
   "$TARGET_IMAGE" \
-  -o "spdx-json=$OUTPUT"
+  -o spdx-json > "$ROOT/$OUTPUT"
 
 test -s "$ROOT/$OUTPUT"
 echo "SBOM written to $OUTPUT"