fix(ci): repair release gate runtime failures

scripts/generate_container_sbom.sh

@@ -5,7 +5,16 @@ ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 TARGET_IMAGE="${1:-geointel-ci:local}"
 OUTPUT="${2:-artifacts/geointel-sbom.spdx.json}"
 SYFT_IMAGE="anchore/syft:v1.44.0@sha256:86fde6445b483d902fe011dd9f68c4987dd94e07da1e9edc004e3c2422650de6"
-SCANNER_ENGINE_ARGS=()
+TMP_DIR="$(mktemp -d)"
+SYFT_CONTAINER=""
+
+cleanup() {
+  if [ -n "$SYFT_CONTAINER" ]; then
+    docker rm -f "$SYFT_CONTAINER" >/dev/null 2>&1 || true
+  fi
+  rm -rf "$TMP_DIR"
+}
+trap cleanup EXIT
 
 case "$OUTPUT" in
   /*|*..*)
@@ -14,36 +23,24 @@ case "$OUTPUT" in
     ;;
 esac
 
-configure_scanner_engine() {
-  local docker_host="${DOCKER_HOST:-}"
-  if [[ "$docker_host" == tcp://* ]]; then
-    local port="${docker_host##*:}"
-    if ! [[ "$port" =~ ^[0-9]+$ ]] || (( port < 1 || port > 65535 )); then
-      echo "Unsupported TCP Docker host for nested scanner: $docker_host" >&2
-      exit 1
-    fi
-    SCANNER_ENGINE_ARGS=(
-      --add-host host.docker.internal:host-gateway
-      -e "DOCKER_HOST=tcp://host.docker.internal:${port}"
-    )
-  elif [[ -z "$docker_host" || "$docker_host" == unix:///var/run/docker.sock ]]; then
-    SCANNER_ENGINE_ARGS=(-v /var/run/docker.sock:/var/run/docker.sock)
-  else
-    echo "Unsupported Docker host for nested scanner: $docker_host" >&2
-    exit 1
-  fi
-}
-
 docker image inspect "$TARGET_IMAGE" >/dev/null
 mkdir -p "$ROOT/$(dirname "$OUTPUT")"
-configure_scanner_engine
 
-# Native/local runs use the normal Unix socket. Gitea jobs can target the
-# isolated TCP DinD daemon; scanner containers then reach that same daemon via
-# Docker's host-gateway alias instead of receiving the Unraid host socket.
-docker run --rm \
-  "${SCANNER_ENGINE_ARGS[@]}" \
-  "$SYFT_IMAGE" \
+# Keep Syft supply-chain pinned to the audited container image, but execute the
+# extracted static binary in the Actions job itself. This lets Syft use the
+# job's existing DOCKER_HOST directly and avoids a second scanner-container ->
+# host-gateway -> DinD network hop for large AI images.
+if ! docker image inspect "$SYFT_IMAGE" >/dev/null 2>&1; then
+  docker pull "$SYFT_IMAGE" >/dev/null
+fi
+SYFT_CONTAINER="$(docker create "$SYFT_IMAGE")"
+docker cp "$SYFT_CONTAINER:/syft" "$TMP_DIR/syft"
+docker rm "$SYFT_CONTAINER" >/dev/null
+SYFT_CONTAINER=""
+chmod +x "$TMP_DIR/syft"
+
+SYFT_CHECK_FOR_APP_UPDATE=false \
+  "$TMP_DIR/syft" \
   "$TARGET_IMAGE" \
   --from docker \
   -o spdx-json > "$ROOT/$OUTPUT"