DISCUSSION: v5 milestone

[laurentsimon]

Let's start collecting and tagging issues with the v5 milestone.

• badges
• raw results (beta release)

[laurentsimon]

cc @azeemsgoogle @naveensrinivasan

[azeemshaikh38]

One item I would add here is deprecation of v1 (pass/fail) code in this release.

[azeemshaikh38]

• Feature: deprecate Pass/Fail model #1393

[azeemshaikh38]

Adding few more:

• Improve scorecard score for scorecard repo #1618
• Feature - Pin dependencies - add support for gclient DEPS file #1597
• Scorecard should try to earn a CII Best Practices badge #1032
• Commit based scorecard #575
• GHSA-mvff-h3cj-wj9c - Vulnerability reported for github.com/containerd/containerd #1537
• Feature Scorecard badges #271
• Feature: add Scorecard to OSS-Fuzz and CIFuzz #1389
• Feature: Separate check for policy/score evaluation #1245

[azeemshaikh38]

Updating this after discussion on the bi-weekly. @justaugustus to add an issue about release process for Scorecard along with the items mentioned above.

[justaugustus]

Updating this after discussion on the bi-weekly. @justaugustus to add an issue about release process for Scorecard along with the items mentioned above.

Added to #1553 as #1676!

[justaugustus]

Unless there are objections, I'm volunteering as tribute/the Release Manager for socrecard v5 :)
It'll give me an opportunity to think through design and process improvements as we get closer to the release date.

---

From #1680 (comment):

I think we should instead declare that the next major release version (v5.0.0) is the first release in which we will be SemVer-compliant and direct our efforts into designing the module in a way that we can ensure that.

I've created a tracking issue for this and added it to the v5 milestone: #1683

[naveensrinivasan]

Unless there are objections, I'm volunteering as tribute/the Release Manager for socrecard v5 :) It'll give me an opportunity to think through design and process improvements as we get closer to the release date.

From #1680 (comment):

I think we should instead declare that the next major release version (v5.0.0) is the first release in which we will be SemVer-compliant and direct our efforts into designing the module in a way that we can ensure that.

I've created a tracking issue for this and added it to the v5 milestone: #1683

+1

[azeemshaikh38]

@ossf/scorecard-maintainers - we have most features implemented here to start thinking about having a v5 release. What do folks think? @justaugustus your input here as the release manager for Scorecard v5 would be very much appreciated :)

[naveensrinivasan]

@ossf/scorecard-maintainers - we have most features implemented here to start thinking about having a v5 release. What do folks think? @justaugustus your input here as the release manager for Scorecard v5 would be very much appreciated :)

👍 This would be a good time to release.

• Scorecards badges
• Scorecards API
• Go 1.18 migration

[github-actions]

This issue is stale because it has been open for 60 days with no activity.

[spencerschrock]

As we get ready to release v5, I was asked to clarify what "done" means now that the tracking issue is 2+ years old. Completion is being tracked through the v5 milestone.

Primarily this consists of three things:

• Structured Results
• Maintainer Annotations
• API changes

The Structured Result changes necessary for feature launch should all be completed at this point. Maintainer Annotations has a few polish PRs up for review, as does the API change.