fix(ci): make release gates DIND-compatible

scripts/generate_container_sbom.sh

@@ -4,6 +4,7 @@ set -euo pipefail
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 TARGET_IMAGE="${1:-geointel-ci:local}"
 OUTPUT="${2:-artifacts/geointel-sbom.spdx.json}"
+IMAGE_ARCHIVE="${GEOINTEL_IMAGE_ARCHIVE:-artifacts/geointel-image.tar}"
 SYFT_IMAGE="anchore/syft:v1.44.0@sha256:86fde6445b483d902fe011dd9f68c4987dd94e07da1e9edc004e3c2422650de6"
 
 case "$OUTPUT" in
@@ -12,9 +13,19 @@ case "$OUTPUT" in
     exit 1
     ;;
 esac
+case "$IMAGE_ARCHIVE" in
+  /*|*..*)
+    echo "Image archive must be a repository-relative path without '..'." >&2
+    exit 1
+    ;;
+esac
 
 docker image inspect "$TARGET_IMAGE" >/dev/null
 mkdir -p "$ROOT/$(dirname "$OUTPUT")"
+if [[ ! -s "$ROOT/$IMAGE_ARCHIVE" ]]; then
+  mkdir -p "$ROOT/$(dirname "$IMAGE_ARCHIVE")"
+  docker save "$TARGET_IMAGE" --output "$ROOT/$IMAGE_ARCHIVE"
+fi
 WORKDIR="/workspace"
 WORKSPACE_ARGS=(-v "$ROOT:/workspace")
 if docker inspect "${HOSTNAME:-}" >/dev/null 2>&1; then
@@ -22,11 +33,10 @@ if docker inspect "${HOSTNAME:-}" >/dev/null 2>&1; then
   WORKSPACE_ARGS=(--volumes-from "$HOSTNAME")
 fi
 docker run --rm \
-  -v /var/run/docker.sock:/var/run/docker.sock \
   "${WORKSPACE_ARGS[@]}" \
   -w "$WORKDIR" \
   "$SYFT_IMAGE" \
-  "$TARGET_IMAGE" \
+  "docker-archive:$WORKDIR/$IMAGE_ARCHIVE" \
   -o "spdx-json=$OUTPUT"
 
 test -s "$ROOT/$OUTPUT"