feat: Add results file input for Scorecard data

[justaugustus]

Summary

Add a results-path Action input that enables reading Scorecard results from a JSON file instead of the public Scorecard API. This enables integration with tools that produce Scorecard results directly, such as Allstar and Scorecard's own --org multi-repo scanning (ossf/scorecard#4793).

Supersedes the experimental hack from commit 51b8e77 with a proper, configurable implementation that supports both API and file-based results modes.

Changes

• action.yml: Add results-path input; make scope not required (repos discovered from results)
• src/index.js: Refactor generateScores() to support both API and file-based results via conditional logic. Both paths converge to the same database enrichment (history, deltas, report generation). Remove hardcoded require('../results.json').
• src/action.js: Restore input reading (was hardcoded by the hack); pass resultsPath to generateScores(); skip scope validation when results file is provided.
• dist/index.js: Rebuilt via ncc
• README.md: Document results-path input and add usage example

Results file format

The input file should contain an array of Scorecard JSON v2 results:

[
  {
    "date": "2026-03-28T15:30:00Z",
    "repo": {
      "name": "github.com/org/repo",
      "commit": "abc123..."
    },
    "score": 6.6,
    "checks": [...]
  }
]

Usage

- uses: ossf/scorecard-monitor@local-results
  with:
    database: database.json
    report: report.md
    results-path: results.json
    auto-commit: true
    auto-push: true

Related PRs

• ossf/allstar#800 — adds -results-file flag to Allstar (producing end)
• ossf/scorecard#4793 — Scorecard --org multi-repo scanning

Test plan

• All 26 existing tests pass
• Manual test: results file parsed correctly (2 repos)
• End-to-end: Allstar produces Scorecard JSON v2 (11 repos) -> scorecard-monitor consumes it -> valid Markdown report with all repos
• API mode: backward compatible (default behavior unchanged when results-path not set)

🤖 Generated with Claude Code