scorecard : Can we get OpenSSF info without a clone?

[cdolfi]

It seems like we should be able to directly call the API

or use an approach like this:
https://github.com/ossf/scorecard#standalone

That could avoid a lot of this issues we are hitting with the scorecard values now

[MoralCode]

I think the scorecard binary also has a few different ways to get data. I believe the way we are using causes it to clone the repo (or otherwise consume disk space proportional to repo size - see #219 ). I think theres an option where we could pass it our own clone paths, but this option doesnt include some of the scorecard metrics.

We may need to thoroughly map out what scorecard criteria each possible route is able to evaluate (and which ones we care about)

The REST API seems to omit these three tests at least:

Scores calculated from our weekly scan omit the CI-Tests, Contributors, and Dependency-Update-Tool checks due to the API costs associated with running them at scale.

[MoralCode]

or use an approach like this:
https://github.com/ossf/scorecard#standalone

This is something we already do. Although the way we use this scorecard binary has a lot to be desired i think.