Existing OpenSSF best practices badge isn't added to a scorecard report

[yrusskih]

Describe the bug
Report doesn't include info about an existing OpenSSF best practices badge.

Reproduction steps
Steps to reproduce the behavior:

1. Fill data necessary for a badge - https://www.bestpractices.dev/en/projects/8774.
2. Open OpenSSF Scorecard Report for the project https://securityscorecards.dev/viewer/?uri=github.com/JetBrains/intellij-community.

Expected behavior
A badge is taken into account for a score and is mentioned in the report.

Actual behavior
The report says "no effort to earn an OpenSSF best practices badge detected".

Additional context
The reason is presumably that badge app requires an URL to a project with "https" while the scorecard report needs the opposite.

• If one queries the badge app URL without https, it shows an empty list https://www.bestpractices.dev/projects.json?url=github.com%2FJetBrains%2Fintellij-community
• If one adds https like https://www.bestpractices.dev/projects.json?url=https%3A%2F%2Fgithub.com%2FJetBrains%2Fintellij-community, they get info from the badge app.

[spencerschrock]

When I run from the command line I see the progress.

scorecard --repo JetBrains/intellij-community --checks CII-Best-Practices --format json --show-details | jq
{
  "date": "2024-04-30T13:39:01-07:00",
  "repo": {
    "name": "github.com/JetBrains/intellij-community",
    "commit": "01b6876bec945bd06e1e375c9ab65a3f4cceedad"
  },
  "scorecard": {
    "version": "devel",
    "commit": "unknown"
  },
  "score": 2.0,
  "checks": [
    {
      "details": null,
      "score": 2,
      "reason": "badge detected: InProgress",
      "name": "CII-Best-Practices",
      "documentation": {
        "url": "https://github.com/ossf/scorecard/blob/main/docs/checks.md#cii-best-practices",
        "short": "Determines if the project has an OpenSSF (formerly CII) Best Practices Badge."
      }
    }
  ],
  "metadata": null
}

I believe this is a problem with our weekly scan infrastructure which has been having issues recently. (related #3983)

[larseggert]

I see the same issue with https://github.com/mozilla/neqo which has a badge (https://www.bestpractices.dev/en/projects/8831)

[spencerschrock]

We were being bad API users so our requests were erroring out. This put the microservice responsible for refreshing the data was in a failure loop. I've submitted a PR to hopefully correct the issue.

[spencerschrock]

The underlying issue has been fixed.

Unfortunately it will take some time to see the fix on your end as both of your repos were already processed for the May 6th weekly run. The value will be correct when re-analyzed during the May 13th run which will be visible to you on May 20th.