From 3b9043a746bb1b3c43ebfc45b4beaa9cc659748a Mon Sep 17 00:00:00 2001
From: Philipp Horstenkamp <philipp@horstenkamp.de>
Date: Mon, 14 Sep 2026 23:25:09 +0200
Subject: [PATCH] feat: detect distro from in-build SBOM PURLs and pass
 --distro to trivy

---
 action.yaml | 38 ++++++++++++++++++++++++++++++++++++--
 1 file changed, 36 insertions(+), 2 deletions(-)

diff --git a/action.yaml b/action.yaml
index 83df1e9..5142aa4 100644
--- a/action.yaml
+++ b/action.yaml
@@ -321,8 +321,25 @@ runs:
           err_log="cve-reports/head/cve-${arch}.err"
 
           echo "Scanning head SBOM for architecture: $arch"
+          distro_arg=""
+          if [ "$use_inbuild" = "true" ]; then
+            detected_distro=$(node -e '
+              const fs = require("fs");
+              const content = fs.readFileSync(process.argv[1], "utf8");
+              const nameMatch = content.match(/[?&]os_name=([^&"\s]+)/);
+              const verMatch = content.match(/[?&]os_version=([^&"\s]+)/);
+              if (nameMatch && verMatch) {
+                console.log(`${nameMatch[1]}/${verMatch[1]}`);
+              }
+            ' "$f" 2>/dev/null || true)
+            if [ -n "$detected_distro" ]; then
+              echo "Detected distribution '${detected_distro}' from in-build SBOM PURLs. Scanning with --distro."
+              distro_arg="--distro ${detected_distro}"
+            fi
+          fi
+
           scan_success=false
-          if trivy sbom --skip-version-check --format json --output "$out_json" "$f" 2>"$err_log"; then
+          if trivy sbom $distro_arg --skip-version-check --format json --output "$out_json" "$f" 2>"$err_log"; then
             scan_success=true
           fi
 
@@ -386,8 +403,25 @@ runs:
           err_log="cve-reports/target/cve-${arch}.err"
 
           echo "Scanning target SBOM for architecture: $arch"
+          distro_arg=""
+          if [ "$use_inbuild" = "true" ]; then
+            detected_distro=$(node -e '
+              const fs = require("fs");
+              const content = fs.readFileSync(process.argv[1], "utf8");
+              const nameMatch = content.match(/[?&]os_name=([^&"\s]+)/);
+              const verMatch = content.match(/[?&]os_version=([^&"\s]+)/);
+              if (nameMatch && verMatch) {
+                console.log(`${nameMatch[1]}/${verMatch[1]}`);
+              }
+            ' "$f" 2>/dev/null || true)
+            if [ -n "$detected_distro" ]; then
+              echo "Detected distribution '${detected_distro}' from in-build SBOM PURLs. Scanning with --distro."
+              distro_arg="--distro ${detected_distro}"
+            fi
+          fi
+
           scan_success=false
-          if trivy sbom --skip-version-check --format json --output "$out_json" "$f" 2>"$err_log"; then
+          if trivy sbom $distro_arg --skip-version-check --format json --output "$out_json" "$f" 2>"$err_log"; then
             scan_success=true
           fi