feat(scorecard): add OpenSSF scorecard

[alizard0]

1. Implemented abstract openssf metric provider, its implementations are added to a list in runtime.
2. Implemented OpenSSF Client (with only one GET request)
3. Implemented tests
4. Review the thresholds
5. Perform end-to-end tests (using frontend)

[rhdh-gh-app]

Important

This PR includes changes that affect public-facing API. Please ensure you are adding/updating documentation for new features or behavior.

Missing Changesets

The following package(s) are changed by this PR but do not have a changeset:

• @red-hat-developer-hub/backstage-plugin-scorecard-backend

See CONTRIBUTING.md for more information about how to add changesets.

Changed Packages

Package Name	Package Path	Changeset Bump	Current Version
backend	workspaces/scorecard/packages/backend	none	v0.0.0
@red-hat-developer-hub/backstage-plugin-scorecard-backend-module-openssf	workspaces/scorecard/plugins/scorecard-backend-module-openssf	minor	v0.0.0
@red-hat-developer-hub/backstage-plugin-scorecard-backend	workspaces/scorecard/plugins/scorecard-backend	none	v2.2.0

[JessicaJHee]

Looks great so far and works! Left a suggestion here, PTAL!

[dzemanov]

Thank you for the PR!

I have only a couple of questions:

1. Default thresholds for numbers are set to following values: <10 success, 10-50 warning, >50 error. Do these thresholds need to be adjusted for openssf metrics, I see the resulting score should be out of 10, -1 is error?
2. Does it make sense to allow admins to configure in app-config different custom thresholds for openssf metrics, or the same score should be always mapped to the same threshold result (success, warning, error)?

[alizard0]

/retest

[alizard0]

/retest

[alizard0]

Quality Gate failed

Failed conditions 11.1% Duplication on New Code (required ≤ 3%)

See analysis details on SonarQube Cloud

I dont agree tbh, the code isn't duplicated. This complains about a list with objects that contains data, the only "duplicated" code is the name of each variable of such objects.

[alizard0]

/retest

[dzemanov]

Thank you @alizard0, works great!

[dzemanov]

You will just need to fix prettier:
yarn prettier:fix

[alizard0]

/retest

[christoph-jerolimov]

/override "SonarCloud Code Analysis"

[openshift-ci]

@christoph-jerolimov: Overrode contexts on behalf of christoph-jerolimov: SonarCloud Code Analysis

Details

In response to this:

/override "SonarCloud Code Analysis"

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[sonarqubecloud]

Quality Gate failed

Failed conditions
11.1% Duplication on New Code (required ≤ 3%)

See analysis details on SonarQube Cloud