fix: set LC_ALL=C.UTF-8 for crypto scanner container

The scanner container inherits the host locale, which can default to
ASCII and cause opengrep to fail with UnicodeDecodeError. Pass
LC_ALL=C.UTF-8 to podman run to ensure UTF-8 decoding.

Also guard the CBOM commit in rebase.sh behind the scan's exit status
so we only commit when the scan actually succeeds.

Author: fracappa

scripts/auto-rebase/crypto_scan.sh

@@ -66,6 +66,7 @@ cp -a "${REPOROOT}/etcd/cmd" "${SCAN_DIR}/etcd-cmd"
 cp -a "${REPOROOT}/etcd/vendor" "${SCAN_DIR}/etcd-deps"
 
 if ! podman run --rm \
+  -e LC_ALL=C.UTF-8 \
   -v "${SCAN_DIR}:/workspace:z" \
   "${SCANNER_IMAGE}" \
   /workspace > "${CBOM_OUTPUT}"; then

scripts/auto-rebase/rebase.sh

@@ -1341,14 +1341,15 @@ rebase_to() {
     # Generate CBOM (Cryptographic Bill of Materials)
     if [[ "${SKIP_CRYPTOSCAN:-}" != "true" ]]; then
         title "## Generating CBOM (Cryptographic Bill of Materials)"
-        ./scripts/auto-rebase/crypto_scan.sh
-        if [[ -n "$(git status -s cbom-microshift.json sbom-microshift-crypto.spdx.json)" ]]; then
-            echo "Updating CBOM"
-            git add cbom-microshift.json sbom-microshift-crypto.spdx.json
-            git commit -m "update cbom"
-        else
-            echo "No changes to CBOM."
-        fi        
+        if ./scripts/auto-rebase/crypto_scan.sh; then
+            if [[ -n "$(git status -s cbom-microshift.json sbom-microshift-crypto.spdx.json)" ]]; then
+                echo "Updating CBOM"
+                git add cbom-microshift.json sbom-microshift-crypto.spdx.json
+                git commit -m "update cbom"
+            else
+                echo "No changes to CBOM."
+            fi
+        fi
     fi
 
     title "# Removing staging directory"