cmd/vulnreport: fix excluded folder bug

Fix bug in which excluded reports would be published to the wrong
folder. This was accidentally introduced in a recent refactor
and no reports were actually published to the wrong folder (this would
have been caught before submit if it had occurred).

Change-Id: Icc9eb99b2ceb185310e99eaa39e45072e0ae6c80
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/590280
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Damien Neil <dneil@google.com>

cmd/vulnreport/creator.go

@@ -139,6 +139,21 @@ func (c *creator) reportFromMeta(ctx context.Context, meta *reportMeta) error {
 		report.WithAliases(aliases),
 		report.WithReviewStatus(meta.reviewStatus),
 	)
+
+	if meta.excluded != "" {
+		raw = &report.Report{
+			ID: meta.id,
+			Modules: []*report.Module{
+				{
+					Module: meta.modulePath,
+				},
+			},
+			Excluded: meta.excluded,
+			CVEs:     raw.CVEs,
+			GHSAs:    raw.GHSAs,
+		}
+	}
+
 	fname, err := raw.YAMLFilename()
 	if err != nil {
 		return err
@@ -173,17 +188,7 @@ func (c *creator) reportFromMeta(ctx context.Context, meta *reportMeta) error {
 
 	switch {
 	case meta.excluded != "":
-		r.Report = &report.Report{
-			ID: meta.id,
-			Modules: []*report.Module{
-				{
-					Module: meta.modulePath,
-				},
-			},
-			Excluded: meta.excluded,
-			CVEs:     r.CVEs,
-			GHSAs:    r.GHSAs,
-		}
+		// nothing
 	case meta.reviewStatus == report.Unreviewed:
 		r.Description = ""
 		addNotes := true