Is your feature request related to a problem? Please describe.
When assessing the security posture of Windows software, there is no way to look up a package by its winget identifier. Users must manually find the source repository before running Scorecard, which is inconsistent with the experience for npm, PyPI, RubyGems, and NuGet.
Describe the solution you'd like
Add a --winget flag that accepts a winget package identifier and automatically resolves the source repository from the microsoft/winget-pkgs manifest, then runs Scorecard against it.
scorecard --winget="Notepad++.Notepad++"
Describe alternatives you've considered
Using the --repo flag directly after manually looking up the repository URL. This works but requires an extra step and breaks the consistency with other package manager flags.
Additional context
Winget is the official Windows package manager with a large and growing catalog. The manifest repository (microsoft/winget-pkgs) is publicly accessible on GitHub and contains the source URL for each package, making resolution straightforward.
Is your feature request related to a problem? Please describe.
When assessing the security posture of Windows software, there is no way to look up a package by its winget identifier. Users must manually find the source repository before running Scorecard, which is inconsistent with the experience for npm, PyPI, RubyGems, and NuGet.
Describe the solution you'd like
Add a --winget flag that accepts a winget package identifier and automatically resolves the source repository from the microsoft/winget-pkgs manifest, then runs Scorecard against it.
scorecard --winget="Notepad++.Notepad++"Describe alternatives you've considered
Using the --repo flag directly after manually looking up the repository URL. This works but requires an extra step and breaks the consistency with other package manager flags.
Additional context
Winget is the official Windows package manager with a large and growing catalog. The manifest repository (microsoft/winget-pkgs) is publicly accessible on GitHub and contains the source URL for each package, making resolution straightforward.