Feature: scoring arbitrary projects hosted on neither GitHub nor GitLab
Amolith opened this issue · comments
Is your feature request related to a problem? Please describe.
The issue I'm experiencing is that I can't check my repo with scorecard because my repo isn't on either GitHub or GitLab.
Describe the solution you'd like
I'd eventually like to see some way to score arbitrary projects. If a check requires a platform-specific API, maybe it should fall back to reading in-repo scorecard config provided by the maintainer, or possibly ask the user whether e.g. code review is required. I don't know that either of those are great solutions, but I definitely think limiting scorecard to just GitHub and GitLab is a shame.
If its goal is improving the entire open source ecosystem, I don't understand why only working with two platforms would be sufficient anyway. Yes, supporting GitHub and GitLab get you 90%+ (arbitrary large number) of the way there. However, that missing 10% is pretty substantive and impactful, including both projects by large enterprises that are critical to a functioning internet and projects created by individuals or smaller businesses who simply decided they wanted to rely on someone else.
Have you tried --local? It only supports a subset of the checks (based on platform specific APIs, #3832 should help slightly).
Although some of the checks that work with --local still assume some GitHub things (there are a few GitHub action specific checks for example)
My apologies, I completely missed that option. From reading through some of the documentation (obviously not enough), my impression was that scorecard didn't have anything like this. Glad to be wrong :)