- parses go.mod/go.sum for your project
- get the dependecies github URL's
- use the above dependencies to filter the data from Bigquery which scorecard cron jobs updates every week.
- export the results as json

./scorecarddata --help
scorecarddata uses the scorecard bigquery to fetch results for dependecies.

Usage:
  scorecarddata [flags]
  scorecarddata [command]

Available Commands:
  completion  generate the autocompletion script for the specified shell
  go          Parses go.mod dependecies and fetches the data from scorecard bigquery for those repositories.
  help        Help about any command
  server      A brief description of your command

Flags:
      --GOOGLE_CLOUD_PROJECT string    The ENV variable that will be used in the BigQuery for querying.
      --config string                  config file (default is $HOME/.scorecarddata.yaml)
      --exclusions-file string         A file with exclusions comma separated by check and value. Example Code-Review,github.com/ossf/scorecard
  -h, --help                           help for scorecarddata
      --scorecard_checks stringArray   The scorecard checks to filter by.Example CI-Tests,Binary-Artifacts etc.https://github.com/ossf/scorecard/blob/main/docs/checks.md (default [Code-Review,Branch-Protection,Pinned-Dependencies,Dependency-Update-Tool,Fuzzing])
  -t, --toggle                         Help message for toggle

Use "scorecarddata [command] --help" for more information about a command.

[
 {
    "Name": "github.com/containerd/ttrpc",
    "Check": "Pinned-Dependencies",
    "Score": 7,
    "Details": "Warn: dependency not pinned by hash (job 'Run Protobuild'): .github/workflows/ci.yml:98",
    "Reason": "dependency not pinned by hash detected -- score normalized to 7"
  },
  {
    "Name": "github.com/kisielk/errcheck",
    "Check": "Pinned-Dependencies",
    "Score": 7,
    "Details": "Info: Third-party actions are pinned",
    "Reason": "dependency not pinned by hash detected -- score normalized to 7"
  }
]

Pinned-Dependencies,github.com/godbus/dbus
Pinned-Dependencies,github.com/kisielk/errcheck

{
  "repositories": [
    "github.com/stretchr/objx"
  ],
  "checks": [
    "Pinned-Dependencies"
    ]
}