Upload things

Author: garazdawi

.github/workflows/main.yaml

@@ -745,8 +745,8 @@ jobs:
           SCANCODE_VERSION=$(docker run --entrypoint="" ghcr.io/oss-review-toolkit/ort-minimal:${{ env.ORT_VERSION }} bash -c "scancode --version" | grep "ScanCode version" | awk '{print $3}')
           docker build -t otp - <<EOF
           FROM otp
-          RUN sudo apt-get install -y pip && pip install scancode-toolkit==${SCANCODE_VERSION} reuse
           RUN echo 'export PATH="\$HOME/.local/bin:\$PATH"' >> /home/otptest/.profile
+          RUN sudo apt-get install -y pip && pip install scancode-toolkit==${SCANCODE_VERSION} reuse
           EOF
 
       - name: Restore from cache
@@ -779,7 +779,7 @@ jobs:
           docker run -v $PWD/:/github -v $HOME:$HOME otp \
                "/github/.github/scripts/ort-scanner.es scan -t reuse -s overwrite \
                -i $HOME/.ort/ort-results/scan-result.json \
-               -o $HOME/.ort/ort-results/scan-result.json /github"
+               -o $HOME/.ort/ort-results/scan-result.reuse.json /github"
 
       - name: Upload scan results
         uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # ratchet:actions/[email protected]
@@ -792,8 +792,8 @@ jobs:
 
       - name: Copy to cache and link results
         run: |
-          cp $HOME/.ort/ort-results/scan-result.json ${{ env.SCAN_RESULT_CACHE_PATH }}
-          ln -f -s scan-result.json $HOME/.ort/ort-results/current-result.json
+          cp $HOME/.ort/ort-results/scan-result.reuse.json ${{ env.SCAN_RESULT_CACHE_PATH }}
+          ln -f -s scan-result.reuse.json $HOME/.ort/ort-results/current-result.json
 
       - name: Run OSS Review Toolkit (reporter)
         uses: oss-review-toolkit/ort-ci-github-action@1805edcf1f4f55f35ae6e4d2d9795ccfb29b6021 # ratchet:oss-review-toolkit/[email protected]
@@ -817,7 +817,7 @@ jobs:
           docker run -v $PWD/:/github -v $HOME:$HOME otp \
                "/github/.github/scripts/otp-compliance.es sbom otp-info \
                  --sbom-file $HOME/.ort/ort-results/bom.spdx.json \
-                 --input-file $HOME/.ort/ort-results/scan-result.json"
+                 --input-file $HOME/.ort/ort-results/scan-result.reuse.json"
 
       - name: Run OSS Review Toolkit (upload)
         uses: oss-review-toolkit/ort-ci-github-action@1805edcf1f4f55f35ae6e4d2d9795ccfb29b6021 # ratchet:oss-review-toolkit/[email protected]
@@ -841,6 +841,33 @@ jobs:
             fail-on: ${{ github.ref_type == 'tag' && '' || '' }} # 'violations,issues' }}
             sw-version: ${{ env.OTP_SBOM_VERSION }}
 
+      - name: Copy to cache and link results
+        run: |
+          ln -f -s scan-result.json $HOME/.ort/ort-results/current-result.json
+
+      - name: Run OSS Review Toolkit (reporter)
+        uses: oss-review-toolkit/ort-ci-github-action@1805edcf1f4f55f35ae6e4d2d9795ccfb29b6021 # ratchet:oss-review-toolkit/[email protected]
+        with:
+            image: ghcr.io/oss-review-toolkit/ort-minimal:${{ env.ORT_VERSION }}
+            run: >
+              reporter
+            report-formats: "SpdxDocument"
+            ort-cli-report-args: '-O SpdxDocument=outputFileFormats=JSON'
+            sw-version: ${{ env.OTP_SBOM_VERSION }}
+
+      - name: Process SBOM
+        run: |
+          docker run -v $PWD/:/github -v $HOME:$HOME otp \
+               "/github/.github/scripts/otp-compliance.es sbom otp-info \
+                 --sbom-file $HOME/.ort/ort-results/bom.spdx.json \
+                 --input-file $HOME/.ort/ort-results/scan-result.json"
+
+      - name: Upload scan results
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # ratchet:actions/[email protected]
+        with:
+          name: ort-no-reuse-sbom
+          path: $HOME/.ort/ort-results/bom.spdx.json
+
   ## If this is an "OTP-*" tag that has been pushed we do some release work
   release:
     name: Release Erlang/OTP