Cleanup documentation code

[laurentsimon]

• Please check if the PR fulfills these requirements

• Tests for the changes have been added (for bug fixes / features)
• PR title follows the guidelines defined in https://github.com/ossf/scorecard/blob/main/CONTRIBUTING.md#pr-process

• What kind of change does this PR introduce? (Bug fix, feature, docs update, ...)
  feature/fix

• What is the current behavior? (You can also link to an open issue here)
  documentation code exposes all internal APIs and check documentation URL not present in JSON.

• What is the new behavior (if this is a feature change)?
  The docs/ folder contains code that is exported by default. This PR:

1. Makes most of the code internal, as explained in here and here
2. Uses the documentation API to add a field in the JSON format.

• Does this PR introduce a breaking change? (What changes might users need to make in their application due to this PR?)
  yes

• Other information:

[laurentsimon]

anyone seen this error before missing ziphash: open hash: no such file or directory in the license verification check?
@naveensrinivasan @chrismcgehee

[naveensrinivasan]

anyone seen this error before missing ziphash: open hash: no such file or directory in the license verification check?
@naveensrinivasan @chrismcgehee

I haven’t.

[laurentsimon]

anyone seen this error before missing ziphash: open hash: no such file or directory in the license verification check?
@naveensrinivasan @chrismcgehee

I haven’t.

I think it has to do with internal packages. go mod verify tries to download the package to verify it has not been changed. But the internal package is not public so the download fails. I need to find a way to tell go mod verify to ignore internal packages.

[azeemshaikh38]

LGTM with comments

[naveensrinivasan]

anyone seen this error before missing ziphash: open hash: no such file or directory in the license verification check?
@naveensrinivasan @chrismcgehee

I haven’t.

I think it has to do with internal packages. go mod verify tries to download the package to verify it has not been changed. But the internal package is not public so the download fails. I need to find a way to tell go mod verify to ignore internal packages.

Why does internal need to have its own module? You can just name the folder as internal and it will not be exposed https://dave.cheney.net/2019/10/06/use-internal-packages-to-reduce-your-public-api-surface

[laurentsimon]

anyone seen this error before missing ziphash: open hash: no such file or directory in the license verification check?
@naveensrinivasan @chrismcgehee

I haven’t.

I think it has to do with internal packages. go mod verify tries to download the package to verify it has not been changed. But the internal package is not public so the download fails. I need to find a way to tell go mod verify to ignore internal packages.

Why does internal need to have its own module? You can just name the folder as internal and it will not be exposed https://dave.cheney.net/2019/10/06/use-internal-packages-to-reduce-your-public-api-surface

I'm not sure why I'm unable to compile.

If I import "github.com/ossf/scorecard/v2/docs/checks/internal/internaldocs", then it complains docs/checks/impl.go:23:2: module github.com/ossf/scorecard@latest found (v1.2.0), but does not contain package github.com/ossf/scorecard/v2/docs/checks/internal/internaldocs.

If I import "./internal/internaldocs", it complains docs/checks/impl.go:23:2: local import "./internal/internaldocs" in non-local package

If I import "internal/internaldocs", it complains docs/checks/impl.go:20:2: package internal/internaldocs is not in GOROOT

If I import "internal/internaldocs" and declare replace internal/einternaldocs => ./docs/checks/external/ in the top go.mod file, it complains scorecard/docs/checks/internal/go.mod: no such file or directory

Thats' why I was creating a module, which seems wrong.

[laurentsimon]

I was creating a module, which seems wrong.

problem solved. The package name was different from the folder name. I've learned my lesson.