Use Scorecard's Go APIs

[laurentsimon]

The entrypoint.sh uses env variables because it was written s a bash script.
The current main.go follows the same design.

We can make the code simpler and more go-native by getting rid of unnecessary env variables.

Env variables that are necessary before running scorecard are https://github.com/ossf/scorecard-action/blob/main/entrypoint.sh#L26-L28 - basically the ones required via command line.

Other env variables, such as https://github.com/ossf/scorecard-action/blob/main/entrypoint.sh#L29-L34 and https://github.com/ossf/scorecard-action/blob/main/entrypoint.sh#L51-L53 can be safely replaced by native go variables.

@naveensrinivasan is this something you have bandwidth for?

cc @azeemshaikh38 @rohankh532

[azeemshaikh38]

+1. In fact, I think we should Golang-ify the code more. Especially, we should move away from running Scorecard as a bash script and run it as a library instead.

[laurentsimon]

@rohankh532 will work on using API instead of CLI as part of the crowdsourcing the results. Is that still the plan?

[naveensrinivasan]

@naveensrinivasan is this something you have bandwidth for?

I can do this after I am done with the things I am working on. I think this can wait.

[azeemshaikh38]

@rohankh532 will work on using API instead of CLI as part of the crowdsourcing the results. Is that still the plan?

@rohankh532 has agreed to work on this. Thanks Rohan!

[laurentsimon]

resolved in #112. Closing this issue

[azeemshaikh38]

Re-opening. I thought the plan was to move to using Scorecard's Go APIs instead of running it in a bash process - #107 (comment)?

[laurentsimon]

you're right. I thought we could create a different issue for this since "remove env variable" is effectively done. Fine to keep it here, though.

[azeemshaikh38]

Makes sense. I updated the title.

[naveensrinivasan]

@rohankh532 Are you planning to finish this up? I am planning to write some tests which will change based on this. I wanted to understand so that I can plan based on that.

[rohankh532]

@rohankh532 Are you planning to finish this up? I am planning to write some tests which will change based on this. I wanted to understand so that I can plan based on that.

Yeah I can. Are there any docs on Scorecard's Go APIs?

[naveensrinivasan]

Here is the CLI code that parses the command line and invokes the API https://github.com/ossf/scorecard/blob/v4.1.0/cmd/root.go

and here are the docs for the Scorecard
https://pkg.go.dev/github.com/ossf/scorecard/v4@v4.1.0

[rohankh532]

I'm pretty stuck on this, could someone else take over?

[azeemshaikh38]

@rohankh532 sure, you can leave this unassigned for now.

[justaugustus]

I'll pick this up, as part of ossf/scorecard#1683.

[azeemshaikh38]

Thanks @justaugustus!

[justaugustus]

Starting on this here: #122

[naveensrinivasan]

Closing this #122

[justaugustus]

Continuing in #79.