Jens/geointel
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(ci): bound Syft binary cataloging
Managed validation / Managed repository validation (pull_request) Successful in 3m48s
Details
GeoIntel release gates / Compile, test, contracts and builds (pull_request) Successful in 3m19s
Details
GeoIntel release gates / Python and npm vulnerability policy (pull_request) Successful in 28s
Details
GeoIntel release gates / Production AI image, SBOM and container scan (pull_request) Successful in 8m37s
Details
GeoIntel release gates / Deploy exact gated revision to Unraid (pull_request) Skipped
Details

Browse Source
This commit is contained in:
Jens
2026-08-30 11:06:46 +02:00
parent bcd023ec36
commit 11de6d0005
2 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/generate_container_sbom.sh
+5
View File
@@ -57,6 +57,10 @@ if [[ -n "${HOSTNAME:-}" ]] && docker inspect --type container "$HOSTNAME" >/dev
WORKSPACE_ARGS=(--volumes-from "$HOSTNAME")
fi
# CUDA and PyTorch ship several gigabytes of native binaries. Syft's heuristic
# binary catalogers exceed the isolated runner's 8 GiB limit on that content.
# Authoritative dpkg, Python, npm and other installed-package catalogers remain
# enabled; Trivy still scans the complete immutable archive independently.
docker run --rm \
--user 0:0 \
-e "SYFT_PARALLELISM=${SYFT_PARALLELISM:-1}" \
@@ -64,6 +68,7 @@ docker run --rm \
-w "$WORKDIR" \
"$SYFT_IMAGE" \
"docker-archive:$WORKDIR/$IMAGE_ARCHIVE" \
--select-catalogers=-binary \
-o "spdx-json=$OUTPUT"
test -s "$ROOT/$OUTPUT"