From 4cc20bcd5ce66bd6704523e7db0ea04f1383285b Mon Sep 17 00:00:00 2001
From: fracappa <fcappa@redhat.com>
Date: Fri, 18 Sep 2026 14:50:19 +0200
Subject: [PATCH] fix: set LC_ALL=C.UTF-8 for crypto scanner container

The scanner container inherits the host locale, which can default to
ASCII and cause opengrep to fail with UnicodeDecodeError. Pass
LC_ALL=C.UTF-8 to podman run to ensure UTF-8 decoding.

Also guard the CBOM commit in rebase.sh behind the scan's exit status
so we only commit when the scan actually succeeds.
---
 scripts/auto-rebase/crypto_scan.sh |  1 +
 scripts/auto-rebase/rebase.sh      | 17 +++++++++--------
 2 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/scripts/auto-rebase/crypto_scan.sh b/scripts/auto-rebase/crypto_scan.sh
index 4c1d27cd02..64740b5473 100755
--- a/scripts/auto-rebase/crypto_scan.sh
+++ b/scripts/auto-rebase/crypto_scan.sh
@@ -66,6 +66,7 @@ cp -a "${REPOROOT}/etcd/cmd" "${SCAN_DIR}/etcd-cmd"
 cp -a "${REPOROOT}/etcd/vendor" "${SCAN_DIR}/etcd-deps"
 
 if ! podman run --rm \
+  -e LC_ALL=C.UTF-8 \
   -v "${SCAN_DIR}:/workspace:z" \
   "${SCANNER_IMAGE}" \
   /workspace > "${CBOM_OUTPUT}"; then
diff --git a/scripts/auto-rebase/rebase.sh b/scripts/auto-rebase/rebase.sh
index e384561a19..2721e175e7 100755
--- a/scripts/auto-rebase/rebase.sh
+++ b/scripts/auto-rebase/rebase.sh
@@ -1341,14 +1341,15 @@ rebase_to() {
     # Generate CBOM (Cryptographic Bill of Materials)
     if [[ "${SKIP_CRYPTOSCAN:-}" != "true" ]]; then
         title "## Generating CBOM (Cryptographic Bill of Materials)"
-        ./scripts/auto-rebase/crypto_scan.sh
-        if [[ -n "$(git status -s cbom-microshift.json sbom-microshift-crypto.spdx.json)" ]]; then
-            echo "Updating CBOM"
-            git add cbom-microshift.json sbom-microshift-crypto.spdx.json
-            git commit -m "update cbom"
-        else
-            echo "No changes to CBOM."
-        fi        
+        if ./scripts/auto-rebase/crypto_scan.sh; then
+            if [[ -n "$(git status -s cbom-microshift.json sbom-microshift-crypto.spdx.json)" ]]; then
+                echo "Updating CBOM"
+                git add cbom-microshift.json sbom-microshift-crypto.spdx.json
+                git commit -m "update cbom"
+            else
+                echo "No changes to CBOM."
+            fi
+        fi
     fi
 
     title "# Removing staging directory"