fix(ci): make release gates DIND-compatible

scripts/generate_container_sbom.sh

@@ -4,6 +4,7 @@ set -euo pipefail
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 TARGET_IMAGE="${1:-geointel-ci:local}"
 OUTPUT="${2:-artifacts/geointel-sbom.spdx.json}"
+IMAGE_ARCHIVE="${GEOINTEL_IMAGE_ARCHIVE:-artifacts/geointel-image.tar}"
 SYFT_IMAGE="anchore/syft:v1.44.0@sha256:86fde6445b483d902fe011dd9f68c4987dd94e07da1e9edc004e3c2422650de6"
 
 case "$OUTPUT" in
@@ -12,9 +13,19 @@ case "$OUTPUT" in
     exit 1
     ;;
 esac
+case "$IMAGE_ARCHIVE" in
+  /*|*..*)
+    echo "Image archive must be a repository-relative path without '..'." >&2
+    exit 1
+    ;;
+esac
 
 docker image inspect "$TARGET_IMAGE" >/dev/null
 mkdir -p "$ROOT/$(dirname "$OUTPUT")"
+if [[ ! -s "$ROOT/$IMAGE_ARCHIVE" ]]; then
+  mkdir -p "$ROOT/$(dirname "$IMAGE_ARCHIVE")"
+  docker save "$TARGET_IMAGE" --output "$ROOT/$IMAGE_ARCHIVE"
+fi
 WORKDIR="/workspace"
 WORKSPACE_ARGS=(-v "$ROOT:/workspace")
 if docker inspect "${HOSTNAME:-}" >/dev/null 2>&1; then
@@ -22,11 +33,10 @@ if docker inspect "${HOSTNAME:-}" >/dev/null 2>&1; then
   WORKSPACE_ARGS=(--volumes-from "$HOSTNAME")
 fi
 docker run --rm \
-  -v /var/run/docker.sock:/var/run/docker.sock \
   "${WORKSPACE_ARGS[@]}" \
   -w "$WORKDIR" \
   "$SYFT_IMAGE" \
-  "$TARGET_IMAGE" \
+  "docker-archive:$WORKDIR/$IMAGE_ARCHIVE" \
   -o "spdx-json=$OUTPUT"
 
 test -s "$ROOT/$OUTPUT"

scripts/scan_container_image.sh

@@ -4,6 +4,7 @@ set -euo pipefail
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 TARGET_IMAGE="${1:-geointel-ci:local}"
 OUTPUT="${2:-artifacts/geointel-container-vulnerabilities.json}"
+IMAGE_ARCHIVE="${GEOINTEL_IMAGE_ARCHIVE:-artifacts/geointel-image.tar}"
 TRIVY_IMAGE="aquasec/trivy:0.70.0@sha256:be1190afcb28352bfddc4ddeb71470835d16462af68d310f9f4bca710961a41e"
 CACHE_DIR="${GEOINTEL_TRIVY_CACHE:-$ROOT/.cache/trivy}"
 PYTHON_CMD="${PYTHON_BIN:-python3}"
@@ -16,9 +17,19 @@ case "$OUTPUT" in
     exit 1
     ;;
 esac
+case "$IMAGE_ARCHIVE" in
+  /*|*..*)
+    echo "Image archive must be a repository-relative path without '..'." >&2
+    exit 1
+    ;;
+esac
 
 docker image inspect "$TARGET_IMAGE" >/dev/null
 mkdir -p "$ROOT/$(dirname "$OUTPUT")" "$CACHE_DIR"
+if [[ ! -s "$ROOT/$IMAGE_ARCHIVE" ]]; then
+  mkdir -p "$ROOT/$(dirname "$IMAGE_ARCHIVE")"
+  docker save "$TARGET_IMAGE" --output "$ROOT/$IMAGE_ARCHIVE"
+fi
 WORKDIR="/workspace"
 WORKSPACE_ARGS=(-v "$ROOT:/workspace")
 if docker inspect "${HOSTNAME:-}" >/dev/null 2>&1; then
@@ -33,27 +44,26 @@ CONTAINER_IGNORE_FILE="$CONTAINER_CACHE_DIR/geointel-trivy-ignore.txt"
 
 # Keep the complete report, including vulnerabilities without an available fix.
 docker run --rm \
-  -v /var/run/docker.sock:/var/run/docker.sock \
   "${WORKSPACE_ARGS[@]}" \
   "$TRIVY_IMAGE" \
   image \
+  --input "$WORKDIR/$IMAGE_ARCHIVE" \
   --scanners vuln \
   --timeout 20m \
   --skip-version-check \
   --format json \
   --cache-dir "$CONTAINER_CACHE_DIR" \
-  --output "$WORKDIR/$OUTPUT" \
-  "$TARGET_IMAGE"
+  --output "$WORKDIR/$OUTPUT"
 
 # Release policy: fixed HIGH/CRITICAL findings block the build. Unfixed findings
 # remain visible in the full report and must be reviewed before release. The
 # postgres base image's Go gosu binary remains discoverable in a lower layer,
 # but the final filesystem replaces it with the audited setpriv shell wrapper.
 docker run --rm \
-  -v /var/run/docker.sock:/var/run/docker.sock \
   "${WORKSPACE_ARGS[@]}" \
   "$TRIVY_IMAGE" \
   image \
+  --input "$WORKDIR/$IMAGE_ARCHIVE" \
   --scanners vuln \
   --timeout 20m \
   --skip-version-check \
@@ -62,8 +72,7 @@ docker run --rm \
   --ignorefile "$CONTAINER_IGNORE_FILE" \
   --skip-files /usr/local/bin/gosu \
   --severity HIGH,CRITICAL \
-  --exit-code 1 \
-  "$TARGET_IMAGE"
+  --exit-code 1
 
 test -s "$ROOT/$OUTPUT"
 echo "Container vulnerability report written to $OUTPUT"