Add a workflow for the ScanCode.io to ORT integration

Signed-off-by: tdruez <[email protected]>

Author: tdruez

.github/workflows/sca-integration-ort-package-file.yml

@@ -0,0 +1,59 @@
+name: Generate ORT package-file.yml with ScanCode.io and load into ORT
+
+# This workflow:
+#  1. Analyze a Docker image using ScanCode.io
+#  1. Generates an ORT `package-file.yml` from the project results
+#  2. Generates an ORT `analyzer-result.yml` using create-analyzer-result-from-package-list
+#  3. Run the ORT report on `analyzer-result.yml` to generate a CycloneDX and SpdxDocument
+
+on:
+  workflow_dispatch:
+#  schedule:
+#    # Run once a week (every 7 days) at 00:00 UTC on Sunday
+#    - cron: "0 0 * * 0"
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+env:
+  SCIO_IMAGE_INPUT: "docker://osadl/alpine-docker-base-image:v3.22-latest"
+  ORT_VERSION: "68.1.0"
+
+jobs:
+  generate-and-load-sbom:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Analyze Docker image with ScanCode.io
+        uses: aboutcode-org/scancode-action@main
+        with:
+          pipelines: "analyze_docker_image"
+          input-urls:
+            "${{ env.SCIO_IMAGE_INPUT }}"
+          scancodeio-repo-branch: "main"
+          output-formats: "ort-package-list spdx cyclonedx json xlsx"
+
+      - name: DEBUG
+        run: |
+          echo ${{ env.PROJECT_WORK_DIRECTORY }}
+
+      - name: Generates an ORT analyzer-result.yml file
+        run: |
+          docker run --rm -v ${{ env.PROJECT_WORK_DIRECTORY }}/output:/data \
+            --entrypoint /opt/ort/bin/orth \
+            ghcr.io/oss-review-toolkit/ort:${{ env.ORT_VERSION }} \
+            create-analyzer-result-from-package-list \
+              --package-list-file /data/package-list.yml \
+              --ort-file /data/analyzer-result.yml
+
+      - name: Generates an ORT analyzer-result.yml file
+        run: |
+          docker run --rm -v ${{ env.PROJECT_WORK_DIRECTORY }}/output:/data \
+          ghcr.io/oss-review-toolkit/ort:${{ env.ORT_VERSION }} \
+          report \
+            --ort-file /data/analyzer-result.yml \
+            --output-dir /data/results/ \
+            --report-formats CycloneDX,SpdxDocument