From e43883872556a5ec7ca15c34aa6303de7eefd07d Mon Sep 17 00:00:00 2001
From: "Darryl L. Miles" <darryl.miles@darrylmiles.org>
Date: Mon, 20 Jul 2026 17:14:36 +0100
Subject: [PATCH] fix: scan docker image for SBOM instead of extracted
 squashfs-root

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
---
 .github/workflows/appimage10.yml | 7 +------
 .github/workflows/appimage7.yml  | 7 +------
 .github/workflows/appimage8.yml  | 7 +------
 .github/workflows/appimage9.yml  | 7 +------
 4 files changed, 4 insertions(+), 24 deletions(-)

diff --git a/.github/workflows/appimage10.yml b/.github/workflows/appimage10.yml
index 50c342c9..ea7cd530 100644
--- a/.github/workflows/appimage10.yml
+++ b/.github/workflows/appimage10.yml
@@ -306,11 +306,6 @@ jobs:
           cd appimage/10
           make validate
 
-      - name: Extract AppImage for SBOM scan
-        run: |
-          cd appimage/10
-          ./${MAGIC_APPIMAGE_OUTPUT_FILENAME} --appimage-extract
-
       - name: Create RELEASE-NOTES.txt
         run: |
           cd appimage/10
@@ -406,7 +401,7 @@ jobs:
       - name: Generate SBOM
         uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
         with:
-          path: ${{ github.workspace }}/appimage/10/squashfs-root
+          image: docker:magic_build
           format: spdx-json
           output-file: ${{ github.workspace }}/appimage/10/sbom-${{env.MAGIC_APPIMAGE_OUTPUT_FILENAME}}.spdx.json
           upload-artifact: false
diff --git a/.github/workflows/appimage7.yml b/.github/workflows/appimage7.yml
index df620a0b..a47d7955 100644
--- a/.github/workflows/appimage7.yml
+++ b/.github/workflows/appimage7.yml
@@ -306,11 +306,6 @@ jobs:
           cd appimage/7
           make validate
 
-      - name: Extract AppImage for SBOM scan
-        run: |
-          cd appimage/7
-          ./${MAGIC_APPIMAGE_OUTPUT_FILENAME} --appimage-extract
-
       - name: Create RELEASE-NOTES.txt
         run: |
           cd appimage/7
@@ -406,7 +401,7 @@ jobs:
       - name: Generate SBOM
         uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
         with:
-          path: ${{ github.workspace }}/appimage/7/squashfs-root
+          image: docker:magic_build
           format: spdx-json
           output-file: ${{ github.workspace }}/appimage/7/sbom-${{env.MAGIC_APPIMAGE_OUTPUT_FILENAME}}.spdx.json
           upload-artifact: false
diff --git a/.github/workflows/appimage8.yml b/.github/workflows/appimage8.yml
index 43da393d..73018014 100644
--- a/.github/workflows/appimage8.yml
+++ b/.github/workflows/appimage8.yml
@@ -306,11 +306,6 @@ jobs:
           cd appimage/8
           make validate
 
-      - name: Extract AppImage for SBOM scan
-        run: |
-          cd appimage/8
-          ./${MAGIC_APPIMAGE_OUTPUT_FILENAME} --appimage-extract
-
       - name: Create RELEASE-NOTES.txt
         run: |
           cd appimage/8
@@ -406,7 +401,7 @@ jobs:
       - name: Generate SBOM
         uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
         with:
-          path: ${{ github.workspace }}/appimage/8/squashfs-root
+          image: docker:magic_build
           format: spdx-json
           output-file: ${{ github.workspace }}/appimage/8/sbom-${{env.MAGIC_APPIMAGE_OUTPUT_FILENAME}}.spdx.json
           upload-artifact: false
diff --git a/.github/workflows/appimage9.yml b/.github/workflows/appimage9.yml
index 60cfdeba..65f8453b 100644
--- a/.github/workflows/appimage9.yml
+++ b/.github/workflows/appimage9.yml
@@ -306,11 +306,6 @@ jobs:
           cd appimage/9
           make validate
 
-      - name: Extract AppImage for SBOM scan
-        run: |
-          cd appimage/9
-          ./${MAGIC_APPIMAGE_OUTPUT_FILENAME} --appimage-extract
-
       - name: Create RELEASE-NOTES.txt
         run: |
           cd appimage/9
@@ -406,7 +401,7 @@ jobs:
       - name: Generate SBOM
         uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
         with:
-          path: ${{ github.workspace }}/appimage/9/squashfs-root
+          image: docker:magic_build
           format: spdx-json
           output-file: ${{ github.workspace }}/appimage/9/sbom-${{env.MAGIC_APPIMAGE_OUTPUT_FILENAME}}.spdx.json
           upload-artifact: false