✨ Update score for branch protection with levels

[laurentsimon]

Update score to work like 'stages':

• first stage: force push, force deletion. if admin, enforce admins. Those give 3/10
• second stage: review >= 1. for admins, up-to-date branch. Those gives 6/10. Maybe up-to-date branch could go to first stage?
• third stage: status checks defined. Gives 8/10.
• fourth stage : reviews >= 2. Gives 9/10
• fifth stage: for admins, dismissal (very hard to use). Gives 10/10

If a stage is not satisfied, the score won't go up regardless of the settings of the next stages. Warn/Info messages are shown for all stage, regardless of the score.
I scorecard is run without admin access, the admin settings are ignored.

@olivekl how shall I word this in the checks.yaml?

FYI, I'm working on the unit tests right now but that should not hamper the review.

[laurentsimon]

friendly ping. ISE would like this check in the cron job's data in a couple weeks.

[asraa]

going to also comment offline as well..

[olivekl]

Suggestions for wording this in checks.yaml (use | before to preserve formatting):

This test has tiered scoring. Each tier must be fully satisfied to achieve points at the next tier. For example, if you fulfill the Tier 3 checks but do not fulfill all the Tier 2 checks, you will not receive any points for Tier 3.

Note: If Scorecard is run without an administrative access token, the requirements that specify “For administrators” are ignored.

Tier 1 Requirements (3/10 points):

• Force push
• Force deletion
• For administrators: Include administrators

Tier 2 Requirements (6/10 points):

• Required reviewers >=1 ​
• For administrators: Strict status checks (require branches to be up-to-date before merging)

Tier 3 Requirements (8/10 points):

• Status checks defined

Tier 4 Requirements (9/10 points):

• Required reviewers >= 2

Tier 5 Requirements (10/10 points):

• For administrators: Dismiss stale reviews

[asraa]

LGTM besides the small comment nits

[laurentsimon]

Thanks @asraa and @azeemsgoogle . Did not mean to be too pushy on this one... kinda came across this way though. @asraa please feel free to start an issue/PR to separate this check, if you're interested in tackling it.
I think one ugly part is the max score which I added for sanity check, it complicates the code and makes it less readable...

[laurentsimon]

FYI Makefile:261: *** GITHUB_AUTH_TOKEN is undefined. Stop. Error: Process completed with exit code 2.

[laurentsimon]

@naveensrinivasan @azeemshaikh38 please approve my integration tests. Thanks

[laurentsimon]

Note: the PR has 2 LGTMs but this does not trigger the automatic approval of the integration test :/

[laurentsimon]

Looks like I'm able to approve my own integration tests!

[github-actions]

Integration tests success for
[00a3e48]
(https://github.com/ossf/scorecard/actions/runs/1483384351)