use getcwd for finding vendors

This change makes this script robust enough to also be callable
if graviton was only required by another package.