perform vendor vulnerab. scanning without sbom

Author: kikofernandez

.github/workflows/main.yaml

@@ -847,8 +847,8 @@ jobs:
             fail-on: ${{ github.ref_type == 'tag' && '' || '' }} # 'violations,issues' }}
             sw-version: ${{ env.OTP_SBOM_VERSION }}
 
-  vendor-analysis:
-    name: Vendor Dependency Analysis
+  vendor-dependency-upload:
+    name: Vendor Dependency Upload
     runs-on: ubuntu-latest
     needs:
         - sbom
@@ -880,6 +880,18 @@ jobs:
         if: github.event_name == 'push'
         uses: advanced-security/spdx-dependency-submission-action@5530bab9ee4bbe66420ce8280624036c77f89746 # ratchet:advanced-security/spdx-dependency-submission-action@v0.1.1
 
+  vendor-analysis:
+    name: Vendor Vulnerability Scanning
+    runs-on: ubuntu-latest
+    needs:
+        - pack
+
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4.2.2
+      - uses: ./.github/actions/build-base-image
+        with:
+            BASE_BRANCH: ${{ env.BASE_BRANCH }}
+
       # check that PRs do not introduce vulnerabilities in vendor dependencies
       - name: 'Vendor Vulnerability Scanning'
         run: |