Release: tracking issue for v2.0.0

[azeemshaikh38]

Tracking issue for the release of v2.0.0.

[azeemshaikh38]

@ossf/scorecard-maintainers - thanks for all the awesome work on v2, we are (almost) ready for launch :) Aiming for a release in September 1st week. Some final pending items and their respective owners:

• Tool to install scorecard-action on multiple repositories Enable action installation on multiple repos #52 - @justaugustus
• Enable throttling and quotas on the Scorecard APIs - @azeemshaikh38
• Move domain name from securityscorecards.dev -> scorecard.dev - @david-a-wheeler @azeemshaikh38
• Fix any open dependabot vulns on scorecard, scorecard-action and scorecard-webapp repositories - @naveensrinivasan has already taken care of this, but just want to call it out.

Happy hacking!

[justaugustus]

@ossf/scorecard-maintainers - thanks for all the awesome work on v2, we are (almost) ready for launch :) Aiming for a release in September 1st week. Some final pending items and their respective owners:

• Tool to install scorecard-action on multiple repositories Enable action installation on multiple repos #52 - @justaugustus

#833 is ready for review!

[justaugustus]

@ossf/scorecard-maintainers -- As a note, the next tag that we release should be v2.0.0-beta.2, v2.0.0-rc.0, or v2.0.0-rc.1.
(The alpha.N tags are out of semantic version order.)

[naveensrinivasan]

Enable throttling and quotas on the Scorecard APIs - @azeemshaikh38

What is going to be the rate limit @azeemshaikh38 ?

[azeemshaikh38]

@justaugustus ah you are right - https://semver.org/#spec-item-11. My bad.

@naveensrinivasan - not sure yet. Still exploring my options through Cloud Endpoints.

[jauderho]

So I upgraded to v2 of the action yesterday and have been experiencing different errors.

1. I was previously using GITHUB_TOKEN and that was working fine. Started getting some secondary rate limit issues while doing so and tried switching to SCORECARD_TOKEN which seems to help somewhat. See https://github.com/jauderho/dockerfiles/runs/8273026121?check_suite_focus=true#step:6:1944

2. For some reason, there is now a request to enter a verification code: Enter the verification code CVQP-FOOD in your browser at: https://oauth2.sigstore.dev/auth/device?user_code=CVQP-FOOD. See https://github.com/jauderho/dockerfiles/runs/8273102236?check_suite_focus=true#step:6:2055

[laurentsimon]

does (2) only occur when you use SCORECARD_TOKEN?

for (1): @azeemshaikh38 @naveensrinivasan shall we add unit tests that monitor the rate limits imposed on a scorecard run?

[laurentsimon]

2. For some reason, there is now a request to enter a verification code: Enter the verification code CVQP-FOOD in your browser at: https://oauth2.sigstore.dev/auth/device?user_code=CVQP-FOOD. See https://github.com/jauderho/dockerfiles/runs/8273102236?check_suite_focus=true#step:6:2055

#898 should fix it

[jauderho]

I'll retry when #898 is merged and released.