Include human friendly links for the GitHub artifacts for Signed-Releases

[spencerschrock]

Is your feature request related to a problem? Please describe.
The links provided in the Signed-Releases check go to the API.

go run main.go --repo ossf/scorecard --checks Signed-Releases --format json --show-details | jq
...
"Info: provenance for release artifact: multiple.intoto.jsonl: https://api.github.com/repos/ossf/scorecard/releases/assets/161822912"
...

Describe the solution you'd like
It would be good to link to a more human friendly (non-API) URL when referencing GitHub release artifacts.

[schaeferka]

I'd like to work on this. I'm here at OpenSSF.

[SilasVM]

Hey @spencerschrock, would a possible solution to this be creating a webpage where users can paste this generated link with a more user-friendly look?

Alternatively, would it be possible to "bake" this landing page into the link generation code, and if so do you have any leads to where the link generation code could be found?

Also, @schaeferka are you still taking on this issue?

Thank you

[spencerschrock]

Hey @spencerschrock, would a possible solution to this be creating a webpage where users can paste this generated link with a more user-friendly look?

I think the solution in this case is much simpler, as GitHub already provides a more human readable URL via the HTMLURL field, we just need to use it.

https://github.com/ossf/scorecard/blob/284b12aa09c42feff8f5519da04e0fedadc19fec/clients/githubrepo/releases.go#L69C27-L76