Gather user feedback/opinions on useful Scorecard metrics

[mayaCostantini]

This issue is part of the following EPIC: #434

4. Implement the global scoring logic

For example, if a software stack is in the 95th percentile of packages with the best development practices (CI/CD, testing...), score it as "A" for this category. Compute a global score from the different category scores.

Gather user feedback/opinions on what metrics would be the most relevant to them

Next steps:

• Discuss with current users of Thoth (i.e. Packit team) about what Scorecard metrics would be the most useful for them to see

[sesheta]

@mayaCostantini: This issue is currently awaiting triage.
If a refinement session determines this is a relevant issue, it will accept the issue by applying the
triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[mayaCostantini]

/sig user-experience
/priority critical-urgent

[goern]

/kind feature

[Gkrumbach07]

/triage accepted

create a google form and send it to teams that use Thoth and aggregate results. Scorecards also give importance information for each metric they provide.

[goern]

let's assume that some scorecard metrics are more useful than others, see https://github.com/ossf/scorecard/blob/main/docs/checks.md so we include

• prevent Trojan: Binary-Artifacts
• prevent Trojan: Branch-Protection
• keep quality: CI-Tests
• keep quality: CII-Best-Practices
• keep quality: Code-Review
• keep quality: Pinned-Dependencies
• maintained code: Contributors
• maintained code: Dependency-Update-Tool
• maintained code: Maintained