diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3af121986ff0..3ea4d763c46a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -172,7 +172,7 @@ jobs:
         scan-type: 'fs'
         format: 'spdx'
         output: 'sbom-karmada.spdx'
-        scan-ref: "/github/workspace/"
+        scan-ref: "${{ github.workspace }}/"
     - name: Tar the sbom files
       run: |
         tar -zcf sbom.tar.gz *.spdx