SCANOSS ORT integration: analyse, scan, and report open source with the OSS Review Toolkit

ORT (the OSS Review Toolkit) is a command line tool that brings SBOM generation, vulnerability scanning, licence analysis, and reporting into one workflow. The SCANOSS integration plugs into ORT's scanner stage, replacing the default fingerprinting with the SCANOSS engine so you can run the full analyse → scan → report cycle against the SCANOSS Knowledge Base or the public OSSKB. This demo walks through the five ORT stages (analyser, scanner, advisor, evaluator, reporter), the prerequisites and installation options (build from source, docker, pre-built binaries), configuring ORT with SCANOSS via the config.yml file, running the analyser and scanner against a sample lodash repository, reviewing the analyser_results.json and scan_results.json outputs, and recording snippet decisions in a .ort.yml file so they persist across future scans. Documentation: https://docs.scanoss.com/en/latest/in... Chapters 00:00 Introduction 00:05 What is ORT and its five stages 00:52 Prerequisites and installation options 01:19 Configuring ORT with SCANOSS 01:31 The core ORT workflow and the iterative process 02:16 Downloading and extracting ORT 02:26 Installing the JDK 25 prerequisite 02:40 Cloning a sample project 02:52 Editing config.yml with the SCANOSS API details 03:04 Running ort analyze and reviewing results 03:32 Running ort scan and reviewing the JSON output 05:29 Recording decisions in .ort.yml with snippet choices 06:11 Rerunning analyze and scan with decisions applied 06:48 Wrap-up scanoss.com