docs: Scorecard-certifier

guac/certifier-scorecard.md

@@ -44,6 +44,7 @@ actionable security insights.
    - Fetches pre-computed results from the OpenSSF Scorecard API
    - Falls back to computing the scorecard with the scorecard library when the
      API request fails
+   - With `--compute`, computes the scores using the scorecard package
 
 3. **Data Ingestion**:
    - Converts scorecard results to structured JSON format
@@ -65,6 +66,7 @@ guaccollect scorecard [options]
 | ---------------------------- | -------------------------------------------------------------- | ------------------- |
 | `--certifier-batch-size int` | Sets the batch size for pagination query for the certifier     | 60000               |
 | `--certifier-latency string` | Sets artificial latency on the certifier (e.g., m, h, s, etc.) | Not enabled (empty) |
+| `--compute`                  | computes the scores using the scorecard package.               | false               |
 | `-h, --help`                 | Help for scorecard                                             |                     |
 | `--interval string`          | Polling interval (e.g., m, h, s, etc.)                         | 5m                  |
 | `--service-poll`             | Enable polling mode                                            | false               |
@@ -84,7 +86,7 @@ guaccollect scorecard [options]
 ### Basic Usage
 
 ```bash
-# Set GitHub token (used by the local computation fallback)
+# Set GitHub token (used by the computation fallback)
 export GITHUB_AUTH_TOKEN=your_github_token
 ```
 
@@ -93,6 +95,16 @@ export GITHUB_AUTH_TOKEN=your_github_token
 guaccollect scorecard
 ```
 
+### Computation by skipping API
+
+```bash
+# computes the scores using the scorecard package
+# Requires GITHUB_AUTH_TOKEN; the certifier exits at startup if it is unset.
+guaccollect scorecard --compute
+```
+
+Useful for air-gapped networks or repositories the public API has never scanned.
+
 ### Polling Mode
 
 ```bash
@@ -118,9 +130,8 @@ guaccollect scorecard \
 - Currently supports GitHub repositories only
 - Requires valid commit SHA or tag reference
 - Results depend on repository accessibility and structure
-- The local computation fallback requires a GitHub authentication token, is
-  slower for large repositories, and may hit GitHub API rate limits at high
-  volume
+- The computation fallback requires a GitHub authentication token, is slower for
+  large repositories, and may hit GitHub API rate limits at high volume
 
 ## Error Handling
 
@@ -133,7 +144,8 @@ Error: GITHUB_AUTH_TOKEN is not set
 ```
 
 **Solution**: Set the `GITHUB_AUTH_TOKEN` environment variable with a valid
-GitHub token.
+GitHub token. Without `--compute` this is only a warning at startup, since the
+API path needs no token; with `--compute` it is a hard error.
 
 ### Rate Limiting