model

type Check ¶

type Check struct {
	Details       []string      `json:"details"`
	Score         int           `json:"score"`
	Reason        string        `json:"reason"`
	Name          string        `json:"name"`
	Documentation Documentation `json:"documentation"`
	Annotations   []string      `json:"annotations,omitempty"`
}

Check is a single Scorecard check result. Details is nullable in the wire format; Annotations is present only when annotations were requested.

type Documentation ¶

type Documentation struct {
	URL   string `json:"url"`
	Short string `json:"short"`
}

Documentation links a check to its human-readable explanation.

type Provenance ¶

type Provenance struct {
	// Source is whether the result was cached or freshly scanned.
	Source Source
	// Commit is the resolved commit SHA the result was computed at.
	Commit string
	// Date is the result's JSON2 generation date.
	Date string
	// ScorecardVersion is the engine version that produced the result.
	ScorecardVersion string
	// Complete reports whether every check produced a conclusive (non-negative)
	// score. This one source-agnostic rule applies to live, cached, and upstream
	// results alike (see scan.Complete).
	Complete bool
}

Provenance describes where a served result came from and how complete it is. The server declares it out of band (HTTP response headers and /capabilities), never inside the canonical JSON2 body, so webapp-compatible clients parse the body unchanged (design D4/D12).

Scorecard results are heuristic signals, not a verdict: provenance lets a client report source, freshness, and completeness rather than assume them.

func ProvenanceFrom(r *Result, src Source, complete bool) Provenance

type Repo ¶

type Repo struct {
	Name   string `json:"name"`
	Commit string `json:"commit"`
}

Repo is the analyzed repository and the commit the result was computed at.

type RepoRef ¶

type RepoRef struct {
	Host string
	Org  string
	Repo string
}

RepoRef identifies a repository the server serves or scans, as parsed from a platform/owner/repo request path.

func ParseRepoRef(host, org, repo string) (RepoRef, error)

func (r RepoRef) Name() string

type Result ¶

type Result struct {
	Date      string    `json:"date"`
	Repo      Repo      `json:"repo"`
	Scorecard Scorecard `json:"scorecard"`
	Score     float64   `json:"score"`
	Checks    []Check   `json:"checks"`
	Metadata  []string  `json:"metadata,omitempty"`
}

Result mirrors the canonical Scorecard JSON2 result body, matching the field layout and JSON tags of pkg/scorecard.JSONScorecardResultV2.

It is used to introspect a result (score, resolved commit, generation date, version); the server serves the original JSON2 bytes rather than re-marshaling this struct, so wire compatibility never depends on it.

Metadata uses omitempty because pkg/scorecard emits "metadata": null while a Scorecard-webapp response omits it entirely; a []string decodes both forms.

func Parse(data []byte) (*Result, error)

type Scorecard ¶

type Scorecard struct {
	Version string `json:"version"`
	Commit  string `json:"commit"`
}

Scorecard is the version of the Scorecard engine that produced the result.

type Source ¶

type Source string

Source indicates how a served result was obtained.

const (
	// SourceCached means the result was served from the store.
	SourceCached Source = "cached"
	// SourceLive means the result was produced by an on-demand scan.
	SourceLive Source = "live"
	// SourceUpstream means the result was fetched from an upstream Scorecard API
	// (the result fallback), not produced locally.
	SourceUpstream Source = "upstream"
)