From f64e5d1772f6355d319771251a7a327a064479cf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jonatan=20M=C3=A4nnchen?= Date: Fri, 14 Aug 2026 13:31:37 +0200 Subject: [PATCH 1/2] Update ORT to v92.2.0 --- .github/workflows/ort/action.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ort/action.yml b/.github/workflows/ort/action.yml index 19b515e2238..43d7fb6679d 100644 --- a/.github/workflows/ort/action.yml +++ b/.github/workflows/ort/action.yml @@ -89,9 +89,9 @@ runs: - name: Run OSS Review Toolkit id: ort - uses: oss-review-toolkit/ort-ci-github-action@1805edcf1f4f55f35ae6e4d2d9795ccfb29b6021 # v1.1.0 + uses: oss-review-toolkit/ort-ci-github-action@086d928d24ef1653dc0777296b312fda5faaaf52 # v1.2.0 with: - image: ghcr.io/oss-review-toolkit/ort-minimal:65.0.0 + image: ghcr.io/oss-review-toolkit/ort-minimal:92.2.0 run: >- labels, cache-dependencies, From e5752929ede107ea74391b95fc5924726e961af4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jonatan=20M=C3=A4nnchen?= Date: Fri, 14 Aug 2026 14:04:53 +0200 Subject: [PATCH 2/2] Switch to Provenant-based scanner Provenant is mostly compatible with ScanCode but a lot faster: in local measurements the scan step went from 6:56 to 44s. Since Provenant is not included in the ort-minimal image, the full ort image is used instead, which slows down the analyzer step (1:08 to 1:44) due to the larger image pull. Still a good reduction overall. --- .github/workflows/ort/action.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ort/action.yml b/.github/workflows/ort/action.yml index 43d7fb6679d..935ef6b6394 100644 --- a/.github/workflows/ort/action.yml +++ b/.github/workflows/ort/action.yml @@ -91,7 +91,7 @@ runs: id: ort uses: oss-review-toolkit/ort-ci-github-action@086d928d24ef1653dc0777296b312fda5faaaf52 # v1.2.0 with: - image: ghcr.io/oss-review-toolkit/ort-minimal:92.2.0 + image: ghcr.io/oss-review-toolkit/ort:92.2.0 run: >- labels, cache-dependencies, @@ -107,4 +107,6 @@ runs: ort-cli-report-args: >- -O CycloneDX=output.file.formats=json,xml -O SpdxDocument=outputFileFormats=JSON,YAML + ort-cli-scan-args: >- + --scanners Provenant sw-version: "${{ inputs.version }}"