Try another way

Author: alexiri

.github/actions/sbom/action.yml

@@ -9,18 +9,22 @@ inputs:
 outputs:
   sbom-path:
     description: The path to the generated SBOM file
-    value: ${{ steps.path.outputs.OUTPUT_PATH }}
+    value: ${{ steps.generate-sbom.outputs.OUTPUT_PATH }}
 
 runs:
   using: "composite"
   steps:
-    - name: Set path for SBOM
-      id: path
-      shell: bash
-      run: echo "OUTPUT_PATH=$(mktemp -d)/sbom.json" >> $GITHUB_OUTPUT
+    - name: Setup Syft
+      id: setup-syft
+      uses: anchore/sbom-action/download-syft@f8bdd1d8ac5e901a77a92f111440fdb1b593736b # v0
 
-    - uses: anchore/sbom-action@v0
-      with:
-        image: ${{ inputs.image-ref }}
-        output-file: ${{ steps.path.outputs.OUTPUT_PATH }}
-        format: spdx-json
+    - name: Generate SBOM
+      id: generate-sbom
+      env:
+        SYFT_CMD: ${{ steps.setup-syft.outputs.cmd }}
+      shell: bash
+      run: |
+        OUTPUT_PATH="`$(mktemp -d)/sbom.json`"
+        export SYFT_PARALLELISM=$(($(nproc)*2))
+        $SYFT_CMD ${{ inputs.image-ref }} --select-catalogers "rpm,+sbom-cataloger" -o spdx-json=${OUTPUT_PATH}
+        echo "OUTPUT_PATH=${OUTPUT_PATH}" >> $GITHUB_OUTPUT