Feature: expose the ecosystem name in Packaging check

[laurentsimon]

We currently don't expose the ecosystem name - raw results and in the logs. We should expose these names properly.

[spencerschrock]

copying from #2495

technically the name could be more complex than just the repo URI, we would need to read go.mod. e.g. scorecard would report github.com/ossf/scorecard even though it's now github.com/ossf/scorecard/v4.

running it on https://github.com/golang/tools/ (which is a mirror) would report that instead of the module name golang.org/x/tools

[laurentsimon]

Agreed that parsing go.mod is the right approach. Starting with the ecosystem name like Go, PyPi would be useful. Realistically, we won't be able to infer package names for other ecosystems unless the registry exposes it after verifying it themselves. Right?

[azeemshaikh38]

What is the motivation for exposing the ecosystem name in Packaging check? Also, how do we handle monorepos?

[laurentsimon]

the check currently looks for ecosystem-specific Actions, so we already surface this implcitely. If we find multiple Actions, we can identify multiples projects in monorepos.

[github-actions[bot]]

Stale issue message - this issue will be closed in 7 days

[github-actions[bot]]

This issue is stale because it has been open for 60 days with no activity.

[github-actions[bot]]

This issue has been marked stale because it has been open for 60 days with no activity.