syft "could not determine source" SBOM generation fails in CI

syft parsed your source argument and could not map it to any supported scheme (a container image, a directory, or an archive). Because it never found a thing to catalog, it exits without writing an SBOM.

What this error means

syft stops with "could not determine source: an image or directory ... could not be found" or "unable to determine source scheme". No SBOM file is written.

error: 1 error occurred:
    * could not determine source: an image or directory could not be found: "myapp:latest"

Common causes

The image was not built or loaded on this runner

You passed myapp:latest but the image only exists in a previous job or the registry, so syft finds nothing locally to scan.

An ambiguous reference without an explicit scheme

Bare references are guessed. A directory that looks like a tag, or a tag with no local image, leaves syft unable to pick a scheme.

How to fix it

Pin the source scheme explicitly

1. Prefix the reference so syft does not have to guess: dir:, docker:, registry:, or oci-archive:.
2. For an image only in a registry, use registry: so syft pulls it directly.
3. Re-run and confirm syft prints the catalogued package count.

# force a registry pull instead of a local lookup
syft registry:ghcr.io/acme/myapp:latest -o cyclonedx-json=sbom.json

Load the image before scanning it

If the image comes from a build job, load or pull it into the runner Docker daemon first so docker: resolves.

docker pull ghcr.io/acme/myapp:latest
syft docker:ghcr.io/acme/myapp:latest -o spdx-json=sbom.spdx.json

How to prevent it

• Always pass an explicit scheme prefix (dir:, docker:, registry:) in CI.
• Generate the SBOM in the same job that builds or pulls the image.
• Verify the reference resolves with docker image inspect before syft runs.

Related guides