fix: don't pass in a separate env. This makes it impossible to pass env vars via the action context to syft.

[iNoahNothing]

Signed-off-by: Noah Krause krausenoah@gmail.com

[kzantow]

Thanks for the contribution.

What environment variables are you setting? Is there a reason you aren't using a configuration file? This action supports a configuration file, either by adding a .syft.yaml in the root of your repository or by using the config parameter.

Instead of picking up environment variables, if you can't use a configuration file, maybe a better solution would be to overload the config parameter to also accept Yaml configuration? E.g. it could look something like this:

      - uses: anchore/sbom-action@v0
        with:
          path: .
          config: |
            log:
              level: debug
            select-catalogers: javascript

Regardless, you'll need to get the files in dist/ updated. This should happen automatically from a git commit hook, which should get installed when you npm install. You can also just run: npm run package.

[iNoahNothing]

What environment variables are you setting?

@kzantow
I am trying to set TMPDIR to update where stereoscope is downloading the image tarball to. Not having the local env passed into the syft run is making it impossible to change this.

Regardless, you'll need to get the files in dist/ updated. This should happen automatically from a git commit hook, which should get installed when you npm install. You can also just run: npm run package.

Thanks! I couldn't figure out the right way to get those updated from the contributing docs.