fix: robustly parse distro from in-build SBOM package PURLs

action.yaml

@@ -310,6 +310,31 @@ runs:
       target_summary=()
       use_inbuild="${{ inputs.use-inbuild-sbom }}"
 
+      detect_distro() {
+        node -e '
+          const fs = require("fs");
+          try {
+            const data = JSON.parse(fs.readFileSync(process.argv[1], "utf8"));
+            let name, ver;
+            for (const pkg of (data.packages || [])) {
+              for (const ref of (pkg.externalRefs || [])) {
+                if (ref.referenceType === "purl" && ref.referenceLocator) {
+                  const mName = ref.referenceLocator.match(/[?&]os_name=([^&]+)/);
+                  const mVer = ref.referenceLocator.match(/[?&]os_version=([^&]+)/);
+                  if (mName && mVer) {
+                    name = mName[1];
+                    ver = mVer[1];
+                    break;
+                  }
+                }
+              }
+              if (name && ver) break;
+            }
+            if (name && ver) console.log(name + "/" + ver);
+          } catch (e) {}
+        ' "$1" 2>/dev/null || true
+      }
+
       # 1. Scan Head SBOMs
       if [ ${#head_sboms[@]} -eq 0 ]; then
         head_ok=false
@@ -323,15 +348,7 @@ runs:
           echo "Scanning head SBOM for architecture: $arch"
           distro_arg=""
           if [ "$use_inbuild" = "true" ]; then
-            detected_distro=$(node -e '
+            detected_distro=$(detect_distro "$f")
-              const fs = require("fs");
-              const content = fs.readFileSync(process.argv[1], "utf8");
-              const nameMatch = content.match(/[?&]os_name=([^&"\s]+)/);
-              const verMatch = content.match(/[?&]os_version=([^&"\s]+)/);
-              if (nameMatch && verMatch) {
-                console.log(`${nameMatch[1]}/${verMatch[1]}`);
-              }
-            ' "$f" 2>/dev/null || true)
             if [ -n "$detected_distro" ]; then
               echo "Detected distribution '${detected_distro}' from in-build SBOM PURLs. Scanning with --distro."
               distro_arg="--distro ${detected_distro}"
@@ -405,15 +422,7 @@ runs:
           echo "Scanning target SBOM for architecture: $arch"
           distro_arg=""
           if [ "$use_inbuild" = "true" ]; then
-            detected_distro=$(node -e '
+            detected_distro=$(detect_distro "$f")
-              const fs = require("fs");
-              const content = fs.readFileSync(process.argv[1], "utf8");
-              const nameMatch = content.match(/[?&]os_name=([^&"\s]+)/);
-              const verMatch = content.match(/[?&]os_version=([^&"\s]+)/);
-              if (nameMatch && verMatch) {
-                console.log(`${nameMatch[1]}/${verMatch[1]}`);
-              }
-            ' "$f" 2>/dev/null || true)
             if [ -n "$detected_distro" ]; then
               echo "Detected distribution '${detected_distro}' from in-build SBOM PURLs. Scanning with --distro."
               distro_arg="--distro ${detected_distro}"