feat: detect distro from in-build SBOM PURLs and pass --distro to trivy

action.yaml

@@ -321,8 +321,25 @@ runs:
           err_log="cve-reports/head/cve-${arch}.err"
 
           echo "Scanning head SBOM for architecture: $arch"
+          distro_arg=""
+          if [ "$use_inbuild" = "true" ]; then
+            detected_distro=$(node -e '
+              const fs = require("fs");
+              const content = fs.readFileSync(process.argv[1], "utf8");
+              const nameMatch = content.match(/[?&]os_name=([^&"\s]+)/);
+              const verMatch = content.match(/[?&]os_version=([^&"\s]+)/);
+              if (nameMatch && verMatch) {
+                console.log(`${nameMatch[1]}/${verMatch[1]}`);
+              }
+            ' "$f" 2>/dev/null || true)
+            if [ -n "$detected_distro" ]; then
+              echo "Detected distribution '${detected_distro}' from in-build SBOM PURLs. Scanning with --distro."
+              distro_arg="--distro ${detected_distro}"
+            fi
+          fi
+
           scan_success=false
-          if trivy sbom --skip-version-check --format json --output "$out_json" "$f" 2>"$err_log"; then
+          if trivy sbom $distro_arg --skip-version-check --format json --output "$out_json" "$f" 2>"$err_log"; then
             scan_success=true
           fi
 
@@ -386,8 +403,25 @@ runs:
           err_log="cve-reports/target/cve-${arch}.err"
 
           echo "Scanning target SBOM for architecture: $arch"
+          distro_arg=""
+          if [ "$use_inbuild" = "true" ]; then
+            detected_distro=$(node -e '
+              const fs = require("fs");
+              const content = fs.readFileSync(process.argv[1], "utf8");
+              const nameMatch = content.match(/[?&]os_name=([^&"\s]+)/);
+              const verMatch = content.match(/[?&]os_version=([^&"\s]+)/);
+              if (nameMatch && verMatch) {
+                console.log(`${nameMatch[1]}/${verMatch[1]}`);
+              }
+            ' "$f" 2>/dev/null || true)
+            if [ -n "$detected_distro" ]; then
+              echo "Detected distribution '${detected_distro}' from in-build SBOM PURLs. Scanning with --distro."
+              distro_arg="--distro ${detected_distro}"
+            fi
+          fi
+
           scan_success=false
-          if trivy sbom --skip-version-check --format json --output "$out_json" "$f" 2>"$err_log"; then
+          if trivy sbom $distro_arg --skip-version-check --format json --output "$out_json" "$f" 2>"$err_log"; then
             scan_success=true
           fi