Feature: output to file

[northdpole]

Is your feature request related to a problem? Please describe.

When running the scorecard docker container in a CI system it would be great if there was an option to write the output to a file.
This way we can avoid having to tee the results out and thus running scorecard in a shell.

Describe the solution you'd like

add a -o option that makes scorecard write the results to the file/path specified by -o

Describe alternatives you've considered

A current workaround is to redirect scorecard's output to a file or wrap it in a script that provides this -o functionality but in both those cases scorecard is not running in a minimal container anymore

Additional context
This sounds like a small change and I would be happy to send you a pull request if you're interested in this feature and can point me to the correct files/dirs that need changing.

[spencerschrock]

This is something that github.com/ossf/scorecard-action also needs a workaround for:
https://github.com/ossf/scorecard-action/blob/7cc371152c77bfecfa34fdfb62b1630ff3682cf1/entrypoint/entrypoint.go#L92-L100

I'm personally in support of a -o option, as the stdout redirect workaround breaks scorecard-action if any logging statements accidentally slip into the code.

Currently if you do --format json, the only thing that is (or rather should be) printed is the json output itself. If provided -o argument I would expect that to disappear as it's written to the output file instead. Is that what you had in mind?

This way we can avoid having to tee the results out and thus running scorecard in a shell.

Seeing as you're using tee now, are you expecting the stdout to stay the same, but also write to a file?

[kittyandrew]

+1 here
I would really love this for my use case. Right now I have to build my custom image on alpine base to redirect output to a file.

[gabibguti]

Hi there! I believe #3192 ended up getting stale and closed and not solving the problem here or in #3191. I can reopen the PR addressing the changes, Spencer.

One thing I would change on the approach tho, is to keep the format argument, as you can still output the result in the TXT or JSON format, but additionally output it to result.json or result.txt or result.log instead of the console.

[spencerschrock]

One thing I would change on the approach tho, is to keep the format argument, as you can still output the result in the TXT or JSON format, but additionally output it to result.json or result.txt or result.log instead of the console.

I'm not sure I follow. I would expect flags to do one thing:

• --format to only change the format
• --output to specify a destination instead of stdout

You're advocating for some sort of --tee?

[gabibguti]

I meant what you said haha. I will open a draft PR, I'm still working on the tests.