fix(ci): repair release gate runtime failures

.gitea/workflows/release-gates.yml

@@ -56,8 +56,6 @@ jobs:
       - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
         with:
           python-version: "3.11"
-          cache: pip
-          cache-dependency-path: backend/requirements-ci.lock
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
         with:
           node-version: "20"
@@ -106,8 +104,6 @@ jobs:
       - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
         with:
           python-version: "3.11"
-          cache: pip
-          cache-dependency-path: backend/requirements-ci.lock
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
         with:
           node-version: "20"

backend/app/services/mdk_bathymetry_probe_service.py

@@ -6,11 +6,12 @@ import ssl
 from typing import Any, Callable
 from urllib.error import HTTPError, URLError
 from urllib.parse import parse_qsl, urlencode, urlsplit, urlunsplit
-from urllib.request import Request, urlopen
+from urllib.request import Request
 from xml.etree import ElementTree
 
 from app.core.config import Settings, get_settings
 from app.schemas.bathymetry import BathymetrySourceProbeRead
+from app.services.outbound_request_guard import guarded_opener
 
 
 class MdkBathymetryProbeService:

scripts/generate_container_sbom.sh

@@ -5,7 +5,16 @@ ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 TARGET_IMAGE="${1:-geointel-ci:local}"
 OUTPUT="${2:-artifacts/geointel-sbom.spdx.json}"
 SYFT_IMAGE="anchore/syft:v1.44.0@sha256:86fde6445b483d902fe011dd9f68c4987dd94e07da1e9edc004e3c2422650de6"
-SCANNER_ENGINE_ARGS=()
+TMP_DIR="$(mktemp -d)"
+SYFT_CONTAINER=""
+
+cleanup() {
+  if [ -n "$SYFT_CONTAINER" ]; then
+    docker rm -f "$SYFT_CONTAINER" >/dev/null 2>&1 || true
+  fi
+  rm -rf "$TMP_DIR"
+}
+trap cleanup EXIT
 
 case "$OUTPUT" in
   /*|*..*)
@@ -14,36 +23,24 @@ case "$OUTPUT" in
     ;;
 esac
 
-configure_scanner_engine() {
-  local docker_host="${DOCKER_HOST:-}"
-  if [[ "$docker_host" == tcp://* ]]; then
-    local port="${docker_host##*:}"
-    if ! [[ "$port" =~ ^[0-9]+$ ]] || (( port < 1 || port > 65535 )); then
-      echo "Unsupported TCP Docker host for nested scanner: $docker_host" >&2
-      exit 1
-    fi
-    SCANNER_ENGINE_ARGS=(
-      --add-host host.docker.internal:host-gateway
-      -e "DOCKER_HOST=tcp://host.docker.internal:${port}"
-    )
-  elif [[ -z "$docker_host" || "$docker_host" == unix:///var/run/docker.sock ]]; then
-    SCANNER_ENGINE_ARGS=(-v /var/run/docker.sock:/var/run/docker.sock)
-  else
-    echo "Unsupported Docker host for nested scanner: $docker_host" >&2
-    exit 1
-  fi
-}
-
 docker image inspect "$TARGET_IMAGE" >/dev/null
 mkdir -p "$ROOT/$(dirname "$OUTPUT")"
-configure_scanner_engine
 
-# Native/local runs use the normal Unix socket. Gitea jobs can target the
-# isolated TCP DinD daemon; scanner containers then reach that same daemon via
-# Docker's host-gateway alias instead of receiving the Unraid host socket.
-docker run --rm \
-  "${SCANNER_ENGINE_ARGS[@]}" \
-  "$SYFT_IMAGE" \
+# Keep Syft supply-chain pinned to the audited container image, but execute the
+# extracted static binary in the Actions job itself. This lets Syft use the
+# job's existing DOCKER_HOST directly and avoids a second scanner-container ->
+# host-gateway -> DinD network hop for large AI images.
+if ! docker image inspect "$SYFT_IMAGE" >/dev/null 2>&1; then
+  docker pull "$SYFT_IMAGE" >/dev/null
+fi
+SYFT_CONTAINER="$(docker create "$SYFT_IMAGE")"
+docker cp "$SYFT_CONTAINER:/syft" "$TMP_DIR/syft"
+docker rm "$SYFT_CONTAINER" >/dev/null
+SYFT_CONTAINER=""
+chmod +x "$TMP_DIR/syft"
+
+SYFT_CHECK_FOR_APP_UPDATE=false \
+  "$TMP_DIR/syft" \
   "$TARGET_IMAGE" \
   --from docker \
   -o spdx-json > "$ROOT/$OUTPUT"