From aca5862fd9090f0bf4ad68c615d8cdddcc8a1b45 Mon Sep 17 00:00:00 2001 From: Nikhil-cp1905 Date: Tue, 18 Aug 2026 14:11:53 +0530 Subject: [PATCH 1/5] docs: scorecard certifier Signed-off-by: Nikhil-cp1905 --- guac/certifier-scorecard.md | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/guac/certifier-scorecard.md b/guac/certifier-scorecard.md index 5758704..2d66d88 100644 --- a/guac/certifier-scorecard.md +++ b/guac/certifier-scorecard.md @@ -44,6 +44,7 @@ actionable security insights. - Fetches pre-computed results from the OpenSSF Scorecard API - Falls back to computing the scorecard with the scorecard library when the API request fails + - With `--compute`, skips the API entirely and only computes locally 3. **Data Ingestion**: - Converts scorecard results to structured JSON format @@ -65,6 +66,7 @@ guaccollect scorecard [options] | ---------------------------- | -------------------------------------------------------------- | ------------------- | | `--certifier-batch-size int` | Sets the batch size for pagination query for the certifier | 60000 | | `--certifier-latency string` | Sets artificial latency on the certifier (e.g., m, h, s, etc.) | Not enabled (empty) | +| `--compute` | Compute scores locally only, skipping the Scorecard API | false | | `-h, --help` | Help for scorecard | | | `--interval string` | Polling interval (e.g., m, h, s, etc.) | 5m | | `--service-poll` | Enable polling mode | false | @@ -93,6 +95,16 @@ export GITHUB_AUTH_TOKEN=your_github_token guaccollect scorecard ``` +### Local Computation Only + +```bash +# Skip the Scorecard API and compute every score locally. +# Requires GITHUB_AUTH_TOKEN; the certifier exits at startup if it is unset. +guaccollect scorecard --compute +``` + +Useful for air-gapped networks or repositories the public API has never scanned. + ### Polling Mode ```bash @@ -133,7 +145,8 @@ Error: GITHUB_AUTH_TOKEN is not set ``` **Solution**: Set the `GITHUB_AUTH_TOKEN` environment variable with a valid -GitHub token. +GitHub token. Without `--compute` this is only a warning at startup, since the +API path needs no token; with `--compute` it is a hard error. ### Rate Limiting From f8da909494dbee454a926bcebc973cc5f2895f19 Mon Sep 17 00:00:00 2001 From: Nikhil C P Date: Tue, 18 Aug 2026 21:30:15 +0530 Subject: [PATCH 2/5] fix: removed 'local' keyword Signed-off-by: Nikhil C P --- guac/certifier-scorecard.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/guac/certifier-scorecard.md b/guac/certifier-scorecard.md index 2d66d88..a9fc2c8 100644 --- a/guac/certifier-scorecard.md +++ b/guac/certifier-scorecard.md @@ -44,7 +44,7 @@ actionable security insights. - Fetches pre-computed results from the OpenSSF Scorecard API - Falls back to computing the scorecard with the scorecard library when the API request fails - - With `--compute`, skips the API entirely and only computes locally + - With `--compute`, computes by skips the API entirely 3. **Data Ingestion**: - Converts scorecard results to structured JSON format @@ -66,7 +66,7 @@ guaccollect scorecard [options] | ---------------------------- | -------------------------------------------------------------- | ------------------- | | `--certifier-batch-size int` | Sets the batch size for pagination query for the certifier | 60000 | | `--certifier-latency string` | Sets artificial latency on the certifier (e.g., m, h, s, etc.) | Not enabled (empty) | -| `--compute` | Compute scores locally only, skipping the Scorecard API | false | +| `--compute` | Compute scores by skipping the Scorecard API | false | | `-h, --help` | Help for scorecard | | | `--interval string` | Polling interval (e.g., m, h, s, etc.) | 5m | | `--service-poll` | Enable polling mode | false | @@ -86,7 +86,7 @@ guaccollect scorecard [options] ### Basic Usage ```bash -# Set GitHub token (used by the local computation fallback) +# Set GitHub token (used by the computation fallback) export GITHUB_AUTH_TOKEN=your_github_token ``` @@ -95,10 +95,10 @@ export GITHUB_AUTH_TOKEN=your_github_token guaccollect scorecard ``` -### Local Computation Only +### Computation by skipping API ```bash -# Skip the Scorecard API and compute every score locally. +# Skip the Scorecard API and compute every score . # Requires GITHUB_AUTH_TOKEN; the certifier exits at startup if it is unset. guaccollect scorecard --compute ``` @@ -130,7 +130,7 @@ guaccollect scorecard \ - Currently supports GitHub repositories only - Requires valid commit SHA or tag reference - Results depend on repository accessibility and structure -- The local computation fallback requires a GitHub authentication token, is +- The computation fallback requires a GitHub authentication token, is slower for large repositories, and may hit GitHub API rate limits at high volume From ee603a1a2f739ce552d19922cce7c337819ee64c Mon Sep 17 00:00:00 2001 From: Nikhil C P Date: Tue, 18 Aug 2026 21:35:30 +0530 Subject: [PATCH 3/5] fix: refactored file Signed-off-by: Nikhil C P --- guac/certifier-scorecard.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/guac/certifier-scorecard.md b/guac/certifier-scorecard.md index a9fc2c8..0c67178 100644 --- a/guac/certifier-scorecard.md +++ b/guac/certifier-scorecard.md @@ -66,7 +66,7 @@ guaccollect scorecard [options] | ---------------------------- | -------------------------------------------------------------- | ------------------- | | `--certifier-batch-size int` | Sets the batch size for pagination query for the certifier | 60000 | | `--certifier-latency string` | Sets artificial latency on the certifier (e.g., m, h, s, etc.) | Not enabled (empty) | -| `--compute` | Compute scores by skipping the Scorecard API | false | +| `--compute` | Compute scores by skipping the Scorecard API | false | | `-h, --help` | Help for scorecard | | | `--interval string` | Polling interval (e.g., m, h, s, etc.) | 5m | | `--service-poll` | Enable polling mode | false | From 7e7ba7ec57406d6f231c8a293f5a228c821e4790 Mon Sep 17 00:00:00 2001 From: Nikhil C P Date: Tue, 18 Aug 2026 21:38:36 +0530 Subject: [PATCH 4/5] fix: refactored few lines Signed-off-by: Nikhil C P --- guac/certifier-scorecard.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/guac/certifier-scorecard.md b/guac/certifier-scorecard.md index 0c67178..42757ee 100644 --- a/guac/certifier-scorecard.md +++ b/guac/certifier-scorecard.md @@ -44,7 +44,7 @@ actionable security insights. - Fetches pre-computed results from the OpenSSF Scorecard API - Falls back to computing the scorecard with the scorecard library when the API request fails - - With `--compute`, computes by skips the API entirely + - With `--compute`, computes the scores using the scorecard package 3. **Data Ingestion**: - Converts scorecard results to structured JSON format @@ -66,7 +66,7 @@ guaccollect scorecard [options] | ---------------------------- | -------------------------------------------------------------- | ------------------- | | `--certifier-batch-size int` | Sets the batch size for pagination query for the certifier | 60000 | | `--certifier-latency string` | Sets artificial latency on the certifier (e.g., m, h, s, etc.) | Not enabled (empty) | -| `--compute` | Compute scores by skipping the Scorecard API | false | +| `--compute` | computes the scores using the scorecard package. | false | | `-h, --help` | Help for scorecard | | | `--interval string` | Polling interval (e.g., m, h, s, etc.) | 5m | | `--service-poll` | Enable polling mode | false | @@ -98,7 +98,7 @@ guaccollect scorecard ### Computation by skipping API ```bash -# Skip the Scorecard API and compute every score . +# computes the scores using the scorecard package # Requires GITHUB_AUTH_TOKEN; the certifier exits at startup if it is unset. guaccollect scorecard --compute ``` From d43a948246b3ff20865f014cab38c365f15e5408 Mon Sep 17 00:00:00 2001 From: Nikhil C P Date: Wed, 19 Aug 2026 20:45:22 +0530 Subject: [PATCH 5/5] fix: lint Signed-off-by: Nikhil C P --- guac/certifier-scorecard.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/guac/certifier-scorecard.md b/guac/certifier-scorecard.md index 42757ee..0039403 100644 --- a/guac/certifier-scorecard.md +++ b/guac/certifier-scorecard.md @@ -130,9 +130,8 @@ guaccollect scorecard \ - Currently supports GitHub repositories only - Requires valid commit SHA or tag reference - Results depend on repository accessibility and structure -- The computation fallback requires a GitHub authentication token, is - slower for large repositories, and may hit GitHub API rate limits at high - volume +- The computation fallback requires a GitHub authentication token, is slower for + large repositories, and may hit GitHub API rate limits at high volume ## Error Handling