DO NOT MERGE THIS - golang staging scheduled #2
Conversation
This is from this run. Golang staging scheduled - https://github.com/ossf-tests/scorecard-action/runs/6187072538?check_suite_focus=true Signed-off-by: naveensrinivasan <172697+naveensrinivasan@users.noreply.github.com>
| }, | ||
| "tool": { | ||
| "driver": { | ||
| "name": "Scorecard", | ||
| "informationUri": "https://github.com/ossf/scorecard", | ||
| "semanticVersion": "4.1.0", | ||
| "semanticVersion": "unknown", |
There was a problem hiding this comment.
this is because we run from HEAD, right?
There was a problem hiding this comment.
After discussion with @laurentsimon, a good chunk of the diff here is because bash script is running at Scorecard v4.1.0 while Golang at v4.1.1-0.20220306220811-4b9f0389c6f6.
We need to release a new version of Scorecard. Update scorecard-action (both bash and Golang) to use this new version and then compare the diffs.
On a separate note, it is not a good sign that our results change so significantly within a minor release. We need better ways to monitor Scorecard quality. |
|
Im going to look into the diff this week. From a cursory read, it looks like mostly details were added for checks that don't have files to be reported, like like Branch-Protection. (This is something I remember adding when a user complained about lack of info) I'll keep you posted later this week |
This is from this run.
Golang staging scheduled - https://github.com/ossf-tests/scorecard-action/runs/6187072538?check_suite_focus=true
Comparison results with the main branch on the scheduled run.
Signed-off-by: naveensrinivasan 172697+naveensrinivasan@users.noreply.github.com