Dependency-Update-Tool false negative when config file is marked export-ignore in .gitattributes

[wnstfy]

Summary

Scorecard's Dependency-Update-Tool check returns score 0 when the dependency-update config file (e.g. renovate.json) is marked export-ignore in .gitattributes, even when the file is present and valid at the repository root.

Root cause

clients/githubrepo/tarball.go (getTarball) downloads the repo via GitHub's /tarball/<ref> endpoint, which honors .gitattributes export-ignore. The downstream check uses OnAllFilesDo (checks/fileparser/listing.go) which iterates only repoClient.ListFiles(...) — i.e., only files present in the tarball. The switch strings.ToLower(name) in checks/raw/dependency_update_tool.go:76 therefore never matches the excluded config, raw.DependencyUpdateToolResults.Tools stays empty, and evaluation.DependencyUpdateTool returns CreateMinScoreResult (score 0).

Repro

• Repo: github.com/wnstify/docker, commit 6bdb2ba
• Scorecard version: v5.3.0 (via ossf/scorecard-action@v2.4.3)
• .gitattributes line: renovate.json export-ignore
• renovate.json is present at repo root, valid JSON, with the standard \$schema reference
• Tarball at https://api.github.com/repos/wnstify/docker/tarball/6bdb2ba returns 69 files; git ls-tree -r returns 87. The 18 missing files all match export-ignore patterns.
• Expected: Dependency-Update-Tool score 10 (renovate.json detected)
• Actual: Dependency-Update-Tool score 0 ("no update tool detected")

Possibly broader scope

This appears to affect any check using OnAllFilesDo over a tarball, since export-ignore exclusion is honored by GitHub's /tarball/ endpoint. Worth an audit by maintainers — I haven't enumerated which other checks share this code path.

Suggested fix

Either:

• (a) Fall back to the git trees API (/repos/<owner>/<repo>/git/trees/<sha>?recursive=1) when a known-name dependency-update config file is missing from the tarball, OR
• (b) Document export-ignore as an incompatibility in the check's docs and the README, so users don't silently lose detection.

Workaround

Remove <config-file> export-ignore from .gitattributes. Trade-off: the file appears in release tarballs (typically ~4 KB).