From 86d612ec936ec6c9f494bb7487516b4855b9cfe8 Mon Sep 17 00:00:00 2001
From: Tomas Dvorak <contact.dvorak@gmail.com>
Date: Mon, 28 Sep 2026 13:52:51 +0200
Subject: [PATCH] fix: lowercase GHCR owner in SBOM image refs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

ghcr.io rejects mixed-case repo paths — syft failed to parse
ghcr.io/Dvorinka/primora-* so the v0.8.0 SBOM job errored.
Apply the same lowercase-owner normalization the image jobs use.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
---
 .github/workflows/release.yml | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 4b81610..22418ee 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -331,6 +331,9 @@ jobs:
       VERSION: ${{ needs.verify.outputs.version }}
     steps:
       - uses: actions/checkout@v4
+      # ghcr.io requires lowercase repo paths; the owner login may be mixed-case.
+      - name: Compute lowercase GHCR owner
+        run: echo "GHCR_OWNER=${GITHUB_REPOSITORY_OWNER,,}" >> "$GITHUB_ENV"
       - uses: docker/login-action@v3
         with:
           registry: ghcr.io
@@ -338,17 +341,17 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
       - uses: anchore/sbom-action@v0
         with:
-          image: ghcr.io/${{ github.repository_owner }}/primora-backend:${{ needs.verify.outputs.version }}
+          image: ghcr.io/${{ env.GHCR_OWNER }}/primora-backend:${{ needs.verify.outputs.version }}
           format: cyclonedx-json
           output-file: dist-release/sbom-backend.cdx.json
       - uses: anchore/sbom-action@v0
         with:
-          image: ghcr.io/${{ github.repository_owner }}/primora-auth:${{ needs.verify.outputs.version }}
+          image: ghcr.io/${{ env.GHCR_OWNER }}/primora-auth:${{ needs.verify.outputs.version }}
           format: cyclonedx-json
           output-file: dist-release/sbom-auth.cdx.json
       - uses: anchore/sbom-action@v0
         with:
-          image: ghcr.io/${{ github.repository_owner }}/primora-frontend:${{ needs.verify.outputs.version }}
+          image: ghcr.io/${{ env.GHCR_OWNER }}/primora-frontend:${{ needs.verify.outputs.version }}
           format: cyclonedx-json
           output-file: dist-release/sbom-frontend.cdx.json
       - uses: anchore/sbom-action@v0