[EPIC] [MVP] Improvements to Thoth advises output about core

[sesheta]

@mayaCostantini: This issue is currently awaiting triage.
If a refinement session determines this is a relevant issue, it will accept the issue by applying the
triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[mayaCostantini]

/sig user-experience
/priority important-soon

[mayaCostantini]

One of the requirements for computing software stack quality scores based on OSSF Scorecards would be to have Scorecards data linked to each project latest release instead of the project repository head commit SHA. This feature request has already been proposed on the scorecards project side.

What about helping them implementing this feature and improving the scorecards cronjob directly instead of computing this data on our side?

cc @goern

[goern]

This sounds reasonable.

Nevertheless, we would use the data via big query?

[mayaCostantini]

This sounds reasonable.

Nevertheless, we would use the data via big query?

Yes, but the information will already be computed in the dataset and we will not need to associate the head commit SHA to the release ourselves.