Jens/geointel
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ci: make SBOM generation nested-runner safe
GeoIntel release gates / Compile, test, contracts and builds (push) Canceled after 0s
Details
GeoIntel release gates / Python and npm vulnerability policy (push) Canceled after 0s
Details
GeoIntel release gates / GIS image, SBOM and container scan (push) Canceled after 0s
Details
GeoIntel release gates / AI image, SBOM and container scan (push) Canceled after 0s
Details

Browse Source
This commit is contained in:
Jens
2026-08-26 23:53:20 +02:00
parent 1a055c5534
commit 07930ec7cb
1 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/generate_container_sbom.sh
+6 -3
View File
@@ -15,13 +15,16 @@ esac
docker image inspect "$TARGET_IMAGE" >/dev/null docker image inspect "$TARGET_IMAGE" >/dev/null
mkdir -p "$ROOT/$(dirname "$OUTPUT")" mkdir -p "$ROOT/$(dirname "$OUTPUT")"
# Gitea/act executes jobs inside a container while Docker commands target the
# host daemon. Host-path binds to $ROOT therefore do not point at the checkout.
# Stream the SPDX document over stdout instead; only the Docker socket crosses
# the nested-runner boundary.
docker run --rm \ docker run --rm \
-v /var/run/docker.sock:/var/run/docker.sock \ -v /var/run/docker.sock:/var/run/docker.sock \
-v "$ROOT:/workspace" \
-w /workspace \
"$SYFT_IMAGE" \ "$SYFT_IMAGE" \
"$TARGET_IMAGE" \ "$TARGET_IMAGE" \
-o "spdx-json=$OUTPUT" -o spdx-json > "$ROOT/$OUTPUT"
test -s "$ROOT/$OUTPUT" test -s "$ROOT/$OUTPUT"
echo "SBOM written to $OUTPUT" echo "SBOM written to $OUTPUT"