🌱 v3 upgrade changes (#1118)

v3 go.mod changes

checker/check_request.go

@@ -17,7 +17,7 @@ package checker
 import (
 	"context"
 
-	"github.com/ossf/scorecard/v2/clients"
+	"github.com/ossf/scorecard/v3/clients"
 )
 
 // CheckRequest struct encapsulates all data to be passed into a CheckFn.

checker/check_runner.go

@@ -23,8 +23,8 @@ import (
 	opencensusstats "go.opencensus.io/stats"
 	"go.opencensus.io/tag"
 
-	sce "github.com/ossf/scorecard/v2/errors"
-	"github.com/ossf/scorecard/v2/stats"
+	sce "github.com/ossf/scorecard/v3/errors"
+	"github.com/ossf/scorecard/v3/stats"
 )
 
 const checkRetries = 3

checks/all_checks.go

@@ -15,7 +15,7 @@
 // Package checks defines all Scorecard checks.
 package checks
 
-import "github.com/ossf/scorecard/v2/checker"
+import "github.com/ossf/scorecard/v3/checker"
 
 // AllChecks is the list of all security checks that will be run.
 var AllChecks = checker.CheckNameToFnMap{}

checks/binary_artifact.go

@@ -22,8 +22,8 @@ import (
 	"github.com/h2non/filetype"
 	"github.com/h2non/filetype/types"
 
-	"github.com/ossf/scorecard/v2/checker"
-	sce "github.com/ossf/scorecard/v2/errors"
+	"github.com/ossf/scorecard/v3/checker"
+	sce "github.com/ossf/scorecard/v3/errors"
 )
 
 // CheckBinaryArtifacts is the exported name for Binary-Artifacts check.

checks/branch_protection.go

@@ -19,9 +19,9 @@ import (
 	"fmt"
 	"regexp"
 
-	"github.com/ossf/scorecard/v2/checker"
-	"github.com/ossf/scorecard/v2/clients"
-	sce "github.com/ossf/scorecard/v2/errors"
+	"github.com/ossf/scorecard/v3/checker"
+	"github.com/ossf/scorecard/v3/clients"
+	sce "github.com/ossf/scorecard/v3/errors"
 )
 
 const (

checks/branch_protection_test.go

@@ -19,11 +19,11 @@ import (
 
 	"github.com/golang/mock/gomock"
 
-	"github.com/ossf/scorecard/v2/checker"
-	"github.com/ossf/scorecard/v2/clients"
-	"github.com/ossf/scorecard/v2/clients/mockrepo"
-	sce "github.com/ossf/scorecard/v2/errors"
-	scut "github.com/ossf/scorecard/v2/utests"
+	"github.com/ossf/scorecard/v3/checker"
+	"github.com/ossf/scorecard/v3/clients"
+	"github.com/ossf/scorecard/v3/clients/mockrepo"
+	sce "github.com/ossf/scorecard/v3/errors"
+	scut "github.com/ossf/scorecard/v3/utests"
 )
 
 func getBranch(branches []*clients.BranchRef, name string) *clients.BranchRef {

checks/ci_tests.go

@@ -18,9 +18,9 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/ossf/scorecard/v2/checker"
-	"github.com/ossf/scorecard/v2/clients"
-	sce "github.com/ossf/scorecard/v2/errors"
+	"github.com/ossf/scorecard/v3/checker"
+	"github.com/ossf/scorecard/v3/clients"
+	sce "github.com/ossf/scorecard/v3/errors"
 )
 
 // States for which CI system is in use.

checks/cii_best_practices.go

@@ -21,8 +21,8 @@ import (
 	"net/http"
 	"strings"
 
-	"github.com/ossf/scorecard/v2/checker"
-	sce "github.com/ossf/scorecard/v2/errors"
+	"github.com/ossf/scorecard/v3/checker"
+	sce "github.com/ossf/scorecard/v3/errors"
 )
 
 // CheckCIIBestPractices is the registered name for CIIBestPractices.

checks/code_review.go

@@ -18,8 +18,8 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/ossf/scorecard/v2/checker"
-	sce "github.com/ossf/scorecard/v2/errors"
+	"github.com/ossf/scorecard/v3/checker"
+	sce "github.com/ossf/scorecard/v3/errors"
 )
 
 // CheckCodeReview is the registered name for DoesCodeReview.

checks/contributors.go

@@ -18,8 +18,8 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/ossf/scorecard/v2/checker"
-	sce "github.com/ossf/scorecard/v2/errors"
+	"github.com/ossf/scorecard/v3/checker"
+	sce "github.com/ossf/scorecard/v3/errors"
 )
 
 const (

checks/dependency_update_tool.go

@@ -17,7 +17,7 @@ package checks
 import (
 	"strings"
 
-	"github.com/ossf/scorecard/v2/checker"
+	"github.com/ossf/scorecard/v3/checker"
 )
 
 // CheckDependencyUpdateTool is the exported name for Automatic-Depdendency-Update.

checks/file_utils.go

@@ -20,9 +20,9 @@ import (
 	"path"
 	"strings"
 
-	"github.com/ossf/scorecard/v2/checker"
-	"github.com/ossf/scorecard/v2/clients"
-	sce "github.com/ossf/scorecard/v2/errors"
+	"github.com/ossf/scorecard/v3/checker"
+	"github.com/ossf/scorecard/v3/clients"
+	sce "github.com/ossf/scorecard/v3/errors"
 )
 
 // isMatchingPath uses 'pattern' to shell-match the 'path' and its filename

checks/fuzzing.go

@@ -20,10 +20,10 @@ import (
 
 	"go.uber.org/zap"
 
-	"github.com/ossf/scorecard/v2/checker"
-	"github.com/ossf/scorecard/v2/clients"
-	"github.com/ossf/scorecard/v2/clients/githubrepo"
-	sce "github.com/ossf/scorecard/v2/errors"
+	"github.com/ossf/scorecard/v3/checker"
+	"github.com/ossf/scorecard/v3/clients"
+	"github.com/ossf/scorecard/v3/clients/githubrepo"
+	sce "github.com/ossf/scorecard/v3/errors"
 )
 
 // CheckFuzzing is the registered name for Fuzzing.

checks/maintained.go

@@ -18,8 +18,8 @@ import (
 	"fmt"
 	"time"
 
-	"github.com/ossf/scorecard/v2/checker"
-	sce "github.com/ossf/scorecard/v2/errors"
+	"github.com/ossf/scorecard/v3/checker"
+	sce "github.com/ossf/scorecard/v3/errors"
 )
 
 const (

checks/packaging.go

@@ -20,8 +20,8 @@ import (
 	"regexp"
 	"strings"
 
-	"github.com/ossf/scorecard/v2/checker"
-	sce "github.com/ossf/scorecard/v2/errors"
+	"github.com/ossf/scorecard/v3/checker"
+	sce "github.com/ossf/scorecard/v3/errors"
 )
 
 // CheckPackaging is the registered name for Packaging.

checks/permissions.go

@@ -20,8 +20,8 @@ import (
 
 	"gopkg.in/yaml.v2"
 
-	"github.com/ossf/scorecard/v2/checker"
-	sce "github.com/ossf/scorecard/v2/errors"
+	"github.com/ossf/scorecard/v3/checker"
+	sce "github.com/ossf/scorecard/v3/errors"
 )
 
 // CheckTokenPermissions is the exported name for Token-Permissions check.

checks/permissions_test.go

@@ -19,8 +19,8 @@ import (
 	"io/ioutil"
 	"testing"
 
-	"github.com/ossf/scorecard/v2/checker"
-	scut "github.com/ossf/scorecard/v2/utests"
+	"github.com/ossf/scorecard/v3/checker"
+	scut "github.com/ossf/scorecard/v3/utests"
 )
 
 //nolint

checks/pinned_dependencies.go

@@ -23,8 +23,8 @@ import (
 	"github.com/moby/buildkit/frontend/dockerfile/parser"
 	"gopkg.in/yaml.v3"
 
-	"github.com/ossf/scorecard/v2/checker"
-	sce "github.com/ossf/scorecard/v2/errors"
+	"github.com/ossf/scorecard/v3/checker"
+	sce "github.com/ossf/scorecard/v3/errors"
 )
 
 // CheckPinnedDependencies is the registered name for FrozenDeps.

checks/pinned_dependencies_test.go

@@ -23,8 +23,8 @@ import (
 	"github.com/google/go-cmp/cmp"
 	"gopkg.in/yaml.v3"
 
-	"github.com/ossf/scorecard/v2/checker"
-	scut "github.com/ossf/scorecard/v2/utests"
+	"github.com/ossf/scorecard/v3/checker"
+	scut "github.com/ossf/scorecard/v3/utests"
 )
 
 func TestGithubWorkflowPinning(t *testing.T) {

checks/sast.go

@@ -17,9 +17,9 @@ package checks
 import (
 	"fmt"
 
-	"github.com/ossf/scorecard/v2/checker"
-	"github.com/ossf/scorecard/v2/clients"
-	sce "github.com/ossf/scorecard/v2/errors"
+	"github.com/ossf/scorecard/v3/checker"
+	"github.com/ossf/scorecard/v3/clients"
+	sce "github.com/ossf/scorecard/v3/errors"
 )
 
 // CheckSAST is the registered name for SAST.

checks/security_policy.go

@@ -20,9 +20,9 @@ import (
 
 	"go.uber.org/zap"
 
-	"github.com/ossf/scorecard/v2/checker"
-	"github.com/ossf/scorecard/v2/clients/githubrepo"
-	sce "github.com/ossf/scorecard/v2/errors"
+	"github.com/ossf/scorecard/v3/checker"
+	"github.com/ossf/scorecard/v3/clients/githubrepo"
+	sce "github.com/ossf/scorecard/v3/errors"
 )
 
 // CheckSecurityPolicy is the registred name for SecurityPolicy.

checks/shell_download_validate.go

@@ -27,8 +27,8 @@ import (
 
 	"mvdan.cc/sh/v3/syntax"
 
-	"github.com/ossf/scorecard/v2/checker"
-	sce "github.com/ossf/scorecard/v2/errors"
+	"github.com/ossf/scorecard/v3/checker"
+	sce "github.com/ossf/scorecard/v3/errors"
 )
 
 var (

checks/signed_releases.go

@@ -18,8 +18,8 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/ossf/scorecard/v2/checker"
-	sce "github.com/ossf/scorecard/v2/errors"
+	"github.com/ossf/scorecard/v3/checker"
+	sce "github.com/ossf/scorecard/v3/errors"
 )
 
 const (

checks/vulnerabilities.go

@@ -21,8 +21,8 @@ import (
 	"net/http"
 	"strings"
 
-	"github.com/ossf/scorecard/v2/checker"
-	sce "github.com/ossf/scorecard/v2/errors"
+	"github.com/ossf/scorecard/v3/checker"
+	sce "github.com/ossf/scorecard/v3/errors"
 )
 
 const (

clients/githubrepo/branches.go

@@ -22,8 +22,8 @@ import (
 	"github.com/google/go-github/v38/github"
 	"github.com/shurcooL/githubv4"
 
-	"github.com/ossf/scorecard/v2/clients"
-	sce "github.com/ossf/scorecard/v2/errors"
+	"github.com/ossf/scorecard/v3/clients"
+	sce "github.com/ossf/scorecard/v3/errors"
 )
 
 const (

clients/githubrepo/checkruns.go

@@ -20,8 +20,8 @@ import (
 
 	"github.com/google/go-github/v38/github"
 
-	"github.com/ossf/scorecard/v2/clients"
-	sce "github.com/ossf/scorecard/v2/errors"
+	"github.com/ossf/scorecard/v3/clients"
+	sce "github.com/ossf/scorecard/v3/errors"
 )
 
 type checkrunsHandler struct {

clients/githubrepo/client.go

@@ -26,9 +26,9 @@ import (
 	"go.uber.org/zap"
 	"go.uber.org/zap/zapcore"
 
-	"github.com/ossf/scorecard/v2/clients"
-	"github.com/ossf/scorecard/v2/clients/githubrepo/roundtripper"
-	sce "github.com/ossf/scorecard/v2/errors"
+	"github.com/ossf/scorecard/v3/clients"
+	"github.com/ossf/scorecard/v3/clients/githubrepo/roundtripper"
+	sce "github.com/ossf/scorecard/v3/errors"
 )
 
 var errInputRepoType = errors.New("input repo should be of type repoURL")

clients/githubrepo/contributors.go

@@ -21,7 +21,7 @@ import (
 
 	"github.com/google/go-github/v38/github"
 
-	"github.com/ossf/scorecard/v2/clients"
+	"github.com/ossf/scorecard/v3/clients"
 )
 
 type contributorsHandler struct {

clients/githubrepo/graphql.go

@@ -21,8 +21,8 @@ import (
 
 	"github.com/shurcooL/githubv4"
 
-	"github.com/ossf/scorecard/v2/clients"
-	sce "github.com/ossf/scorecard/v2/errors"
+	"github.com/ossf/scorecard/v3/clients"
+	sce "github.com/ossf/scorecard/v3/errors"
 )
 
 const (

clients/githubrepo/releases.go

@@ -21,8 +21,8 @@ import (
 
 	"github.com/google/go-github/v38/github"
 
-	"github.com/ossf/scorecard/v2/clients"
-	sce "github.com/ossf/scorecard/v2/errors"
+	"github.com/ossf/scorecard/v3/clients"
+	sce "github.com/ossf/scorecard/v3/errors"
 )
 
 type releasesHandler struct {

clients/githubrepo/repo_url.go

@@ -19,8 +19,8 @@ import (
 	"net/url"
 	"strings"
 
-	"github.com/ossf/scorecard/v2/clients"
-	sce "github.com/ossf/scorecard/v2/errors"
+	"github.com/ossf/scorecard/v3/clients"
+	sce "github.com/ossf/scorecard/v3/errors"
 )
 
 const (

clients/githubrepo/roundtripper/census.go

@@ -22,8 +22,8 @@ import (
 	opencensusstats "go.opencensus.io/stats"
 	"go.opencensus.io/tag"
 
-	sce "github.com/ossf/scorecard/v2/errors"
-	"github.com/ossf/scorecard/v2/stats"
+	sce "github.com/ossf/scorecard/v3/errors"
+	"github.com/ossf/scorecard/v3/stats"
 )
 
 const fromCacheHeader = "X-From-Cache"

clients/githubrepo/roundtripper/rate_limit.go

@@ -22,7 +22,7 @@ import (
 
 	"go.uber.org/zap"
 
-	sce "github.com/ossf/scorecard/v2/errors"
+	sce "github.com/ossf/scorecard/v3/errors"
 )
 
 // MakeRateLimitedTransport returns a RoundTripper which rate limits GitHub requests.

clients/githubrepo/roundtripper/transport.go

@@ -24,7 +24,7 @@ import (
 	"go.opencensus.io/stats"
 	"go.opencensus.io/tag"
 
-	githubstats "github.com/ossf/scorecard/v2/clients/githubrepo/stats"
+	githubstats "github.com/ossf/scorecard/v3/clients/githubrepo/stats"
 )
 
 const expiryTimeInSec = 30

clients/githubrepo/search.go

@@ -22,7 +22,7 @@ import (
 
 	"github.com/google/go-github/v38/github"
 
-	"github.com/ossf/scorecard/v2/clients"
+	"github.com/ossf/scorecard/v3/clients"
 )
 
 var errEmptyQuery = errors.New("search query is empty")