fix(ossf/scorecard): Re-scaffold (#32063)

* feat(ossf/scorecard): scaffold ossf/scorecard

* fix(ossf/scorecard): fix files

pkgs/ossf/scorecard/pkg.yaml

@@ -1,10 +1,18 @@
 packages:
-  - name: ossf/scorecard@v5.0.0
+  - name: ossf/scorecard@v5.1.0
+  - name: ossf/scorecard
+    version: v5.0.0
   - name: ossf/scorecard
     version: v4.8.0
   - name: ossf/scorecard
     version: v4.5.0
   - name: ossf/scorecard
     version: v4.4.0
   - name: ossf/scorecard
-    version: v4.3.1
+    version: v3.0.1
+  - name: ossf/scorecard
+    version: v2.1.3
+  - name: ossf/scorecard
+    version: v2.1.2
+  - name: ossf/scorecard
+    version: v1.1.0

pkgs/ossf/scorecard/registry.yaml

@@ -3,25 +3,73 @@ packages:
   - type: github_release
     repo_owner: ossf
     repo_name: scorecard
-    description: Security Scorecards - Security health metrics for Open Source
+    description: OpenSSF Scorecard - Security health metrics for Open Source
     version_constraint: "false"
     version_overrides:
-      - version_constraint: semver("< 4.5.0")
-        asset: scorecard_{{trimV .Version}}_{{.OS}}_{{.Arch}}.tar.gz
+      - version_constraint: semver("<= 1.0.0") || Version == "v4.9.0"
+        no_asset: true
+      - version_constraint: Version == "v1.1.0"
+        asset: scorecard_{{trimV .Version}}_{{.OS}}_{{.Arch}}.{{.Format}}
+        format: tar.gz
+        rosetta2: true
+        checksum:
+          type: github_release
+          asset: scorecard_{{trimV .Version}}_checksums.txt
+          algorithm: sha256
+        supported_envs:
+          - linux
+          - darwin
+      - version_constraint: semver("<= 2.1.2")
+        asset: scorecard_{{trimV .Version}}_{{.OS}}_{{.Arch}}.{{.Format}}
+        format: tar.gz
+        rosetta2: true
+        windows_arm_emulation: true
+        replacements:
+          amd64: x86_64
+          linux: Linux
+        checksum:
+          type: github_release
+          asset: scorecard_{{trimV .Version}}_checksums.txt
+          algorithm: sha512
+      - version_constraint: Version == "v2.1.3"
+        asset: scorecard_{{trimV .Version}}_{{.OS}}_{{.Arch}}.{{.Format}}
+        format: tar.gz
+        windows_arm_emulation: true
+        replacements:
+          amd64: x86_64
+          linux: Linux
+        checksum:
+          type: github_release
+          asset: scorecard_{{trimV .Version}}_checksums.txt
+          algorithm: sha512
+      - version_constraint: semver("<= 3.0.1")
+        asset: scorecard_{{trimV .Version}}_{{.OS}}_{{.Arch}}.{{.Format}}
+        format: tar.gz
+        replacements:
+          amd64: x86_64
+          linux: Linux
+        checksum:
+          type: github_release
+          asset: scorecard_{{trimV .Version}}_checksums.txt
+          algorithm: sha512
+      - version_constraint: semver("<= 4.4.0")
+        asset: scorecard_{{trimV .Version}}_{{.OS}}_{{.Arch}}.{{.Format}}
+        format: tar.gz
         files:
           - name: scorecard
             src: scorecard-{{.OS}}-{{.Arch}}
+        checksum:
+          type: github_release
+          asset: scorecard_checksums.txt
+          algorithm: sha512
         overrides:
           - goos: linux
             goarch: amd64
             checksum:
               enabled: false
-        checksum:
-          type: github_release
-          asset: scorecard_checksums.txt
-          algorithm: sha512
       - version_constraint: Version == "v4.5.0"
-        asset: scorecard_{{trimV .Version}}_{{.OS}}_{{.Arch}}.tar.gz
+        asset: scorecard_{{trimV .Version}}_{{.OS}}_{{.Arch}}.{{.Format}}
+        format: tar.gz
         files:
           - name: scorecard
             src: scorecard-{{.OS}}-{{.Arch}}
@@ -30,37 +78,39 @@ packages:
           asset: scorecard_checksums.txt
           algorithm: sha512
         supported_envs:
+          - linux/arm64
           - darwin
           - windows
-          - linux/arm64
-      - version_constraint: semver("< 4.9.0")
-        asset: scorecard_{{trimV .Version}}_{{.OS}}_{{.Arch}}.tar.gz
+      - version_constraint: semver("<= 4.8.0")
+        asset: scorecard_{{trimV .Version}}_{{.OS}}_{{.Arch}}.{{.Format}}
+        format: tar.gz
         files:
           - name: scorecard
             src: scorecard-{{.OS}}-{{.Arch}}
         checksum:
           type: github_release
           asset: scorecard_checksums.txt
           algorithm: sha256
-        supported_envs:
-          - darwin
-          - windows
-          - linux/arm64
-      - version_constraint: Version == "v4.9.0"
-        no_asset: true
-      - version_constraint: "true"
-        asset: scorecard_{{trimV .Version}}_{{.OS}}_{{.Arch}}.tar.gz
+      - version_constraint: semver("<= 5.0.0")
+        asset: scorecard_{{trimV .Version}}_{{.OS}}_{{.Arch}}.{{.Format}}
+        format: tar.gz
         files:
           - name: scorecard
             src: scorecard-{{.OS}}-{{.Arch}}
         checksum:
           type: github_release
           asset: scorecard_checksums.txt
           algorithm: sha256
-        supported_envs:
-          - darwin
-          - windows
-          - linux/arm64
+        slsa_provenance:
+          type: github_release
+          asset: multiple.intoto.jsonl
+      - version_constraint: "true"
+        asset: scorecard_{{trimV .Version}}_{{.OS}}_{{.Arch}}.{{.Format}}
+        format: tar.gz
+        checksum:
+          type: github_release
+          asset: scorecard_checksums.txt
+          algorithm: sha256
         slsa_provenance:
           type: github_release
           asset: multiple.intoto.jsonl