[feature] Only use Scorecard API so that we can use deps.dev/api/v3alpha about guac HOT 4 OPEN

👀 @pxp928 @jeffmendoza @lumjjb @mihaimaruseac

from guac.

Based on discussion in the June 10 meeting, there is still a use case that could use the scorecard certifier functionality. Proposal is not to delete but move this to another repository under guacsec as a "contrib". @nathannaveen would you be interested in exploring this as a separate repo?

from guac.

@lumjjb thank you for the update from the meetings discussion! I would be interested in working on this.

from guac.

I recently realized that we directly utilize osv-scanner.

I didn't think of the direct osv-scanner dependency while creating this issue, so I think we should take a minute to rethink this before moving the scorecard certifier to another repo. Moving the scorecard certifier to another repo won't really solve our issue since we will still have the osv-scanner dependency (which intern gives us the deps.dev/api/v3 dependency).

Additionally, we will probably not be able to use the deps.dev/api/v3alpha API until it becomes stable because of #1768 (comment).

from guac.