fix(ci): cap Syft heap inside DinD

scripts/generate_container_sbom.sh

@@ -57,13 +57,16 @@ if [[ -n "${HOSTNAME:-}" ]] && docker inspect --type container "$HOSTNAME" >/dev
   WORKSPACE_ARGS=(--volumes-from "$HOSTNAME")
 fi
 
-# CUDA and PyTorch ship several gigabytes of native binaries. Syft's heuristic
-# binary catalogers exceed the isolated runner's 8 GiB limit on that content.
-# Authoritative dpkg, Python, npm and other installed-package catalogers remain
-# enabled; Trivy still scans the complete immutable archive independently.
+# CUDA and PyTorch ship several gigabytes of native binaries. Keep Syft's Go
+# heap below the isolated runner's 8 GiB limit and collect garbage proactively;
+# otherwise the Docker-in-Docker job can be OOM-killed even with one cataloger
+# worker. Authoritative dpkg, Python, npm and other installed-package catalogers
+# remain enabled; Trivy still scans the complete immutable archive independently.
 docker run --rm \
   --user 0:0 \
   -e "SYFT_PARALLELISM=${SYFT_PARALLELISM:-1}" \
+  -e "GOMEMLIMIT=${SYFT_GOMEMLIMIT:-4GiB}" \
+  -e "GOGC=${SYFT_GOGC:-25}" \
   "${WORKSPACE_ARGS[@]}" \
   -w "$WORKDIR" \
   "$SYFT_IMAGE" \