fix(ci): restore exact AI release evidence gates

scripts/generate_container_sbom.sh

@@ -4,24 +4,67 @@ set -euo pipefail
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 TARGET_IMAGE="${1:-geointel-ci:local}"
 OUTPUT="${2:-artifacts/geointel-sbom.spdx.json}"
+IMAGE_ARCHIVE="${GEOINTEL_IMAGE_ARCHIVE:-artifacts/geointel-image.tar}"
+ARCHIVE_ID_FILE="${IMAGE_ARCHIVE}.image-id"
+KEEP_ARCHIVE="${GEOINTEL_KEEP_IMAGE_ARCHIVE:-false}"
 SYFT_IMAGE="anchore/syft:v1.44.0@sha256:86fde6445b483d902fe011dd9f68c4987dd94e07da1e9edc004e3c2422650de6"
+ARCHIVE_CREATED=false
+PARTIAL_ARCHIVE=""
 
-case "$OUTPUT" in
-  /*|*..*)
-    echo "SBOM output must be a repository-relative path without '..'." >&2
-    exit 1
-    ;;
-esac
+cleanup() {
+  if [ -n "$PARTIAL_ARCHIVE" ]; then
+    rm -f -- "$PARTIAL_ARCHIVE"
+  fi
+  if [ "$ARCHIVE_CREATED" = true ] && [ "$KEEP_ARCHIVE" != true ]; then
+    rm -f -- "$ROOT/$IMAGE_ARCHIVE" "$ROOT/$ARCHIVE_ID_FILE"
+  fi
+}
+trap cleanup EXIT
+
+for candidate in "$OUTPUT" "$IMAGE_ARCHIVE"; do
+  case "$candidate" in
+    /*|*..*)
+      echo "SBOM paths must be repository-relative and may not contain '..'." >&2
+      exit 1
+      ;;
+  esac
+done
+
+IMAGE_ID="$(docker image inspect --format '{{.Id}}' "$TARGET_IMAGE")"
+test -n "$IMAGE_ID"
+mkdir -p "$ROOT/$(dirname "$OUTPUT")" "$ROOT/$(dirname "$IMAGE_ARCHIVE")"
+
+ARCHIVE_ID=""
+if [ -s "$ROOT/$ARCHIVE_ID_FILE" ]; then
+  ARCHIVE_ID="$(tr -d '[:space:]' < "$ROOT/$ARCHIVE_ID_FILE")"
+fi
+if [ ! -s "$ROOT/$IMAGE_ARCHIVE" ] || [ "$ARCHIVE_ID" != "$IMAGE_ID" ]; then
+  rm -f -- "$ROOT/$IMAGE_ARCHIVE" "$ROOT/$ARCHIVE_ID_FILE"
+  PARTIAL_ARCHIVE="$ROOT/${IMAGE_ARCHIVE}.partial.$$"
+  docker save "$IMAGE_ID" --output "$PARTIAL_ARCHIVE"
+  mv "$PARTIAL_ARCHIVE" "$ROOT/$IMAGE_ARCHIVE"
+  PARTIAL_ARCHIVE=""
+  printf '%s\n' "$IMAGE_ID" > "$ROOT/$ARCHIVE_ID_FILE"
+  ARCHIVE_CREATED=true
+fi
+
+WORKDIR="/workspace"
+WORKSPACE_ARGS=(-v "$ROOT:/workspace")
+if [[ -n "${HOSTNAME:-}" ]] && docker inspect --type container "$HOSTNAME" >/dev/null 2>&1; then
+  # The Gitea job runs against TCP DinD. Reusing its workspace mounts keeps
+  # the archive inside the job boundary and avoids a privileged Docker API hop.
+  WORKDIR="$ROOT"
+  WORKSPACE_ARGS=(--volumes-from "$HOSTNAME")
+fi
 
-docker image inspect "$TARGET_IMAGE" >/dev/null
-mkdir -p "$ROOT/$(dirname "$OUTPUT")"
 docker run --rm \
-  -v /var/run/docker.sock:/var/run/docker.sock \
-  -v "$ROOT:/workspace" \
-  -w /workspace \
+  --user 0:0 \
+  -e "SYFT_PARALLELISM=${SYFT_PARALLELISM:-1}" \
+  "${WORKSPACE_ARGS[@]}" \
+  -w "$WORKDIR" \
   "$SYFT_IMAGE" \
-  "docker:$TARGET_IMAGE" \
+  "docker-archive:$WORKDIR/$IMAGE_ARCHIVE" \
   -o "spdx-json=$OUTPUT"
 
 test -s "$ROOT/$OUTPUT"
-echo "SBOM written to $OUTPUT"
+echo "SBOM written to $OUTPUT for $IMAGE_ID"