🌱 Fix the go.mod with v2 upgrade (#716)

The go.mod and the related files weren't t updated with the v2 upgrade.

https://github.com/ossf/scorecard/issues/711

This fix will address the issue.

checker/check_request.go

@@ -21,7 +21,7 @@ import (
 	"github.com/google/go-github/v32/github"
 	"github.com/shurcooL/githubv4"
 
-	"github.com/ossf/scorecard/clients"
+	"github.com/ossf/scorecard/v2/clients"
 )
 
 type CheckRequest struct {

checker/check_result.go

@@ -20,7 +20,7 @@ import (
 	"math"
 	"strings"
 
-	scorecarderrors "github.com/ossf/scorecard/errors"
+	scorecarderrors "github.com/ossf/scorecard/v2/errors"
 )
 
 // UPGRADEv2: to remove.

checker/check_runner.go

@@ -23,8 +23,8 @@ import (
 	opencensusstats "go.opencensus.io/stats"
 	"go.opencensus.io/tag"
 
-	scorecarderrors "github.com/ossf/scorecard/errors"
-	"github.com/ossf/scorecard/stats"
+	scorecarderrors "github.com/ossf/scorecard/v2/errors"
+	"github.com/ossf/scorecard/v2/stats"
 )
 
 const checkRetries = 3

checks/active.go

@@ -20,8 +20,8 @@ import (
 
 	"github.com/google/go-github/v32/github"
 
-	"github.com/ossf/scorecard/checker"
-	sce "github.com/ossf/scorecard/errors"
+	"github.com/ossf/scorecard/v2/checker"
+	sce "github.com/ossf/scorecard/v2/errors"
 )
 
 const (

checks/all_checks.go

@@ -14,7 +14,7 @@
 
 package checks
 
-import "github.com/ossf/scorecard/checker"
+import "github.com/ossf/scorecard/v2/checker"
 
 // AllChecks is the list of all security checks that will be run.
 var AllChecks = checker.CheckNameToFnMap{}

checks/automatic_dependency_update.go

@@ -17,7 +17,7 @@ package checks
 import (
 	"strings"
 
-	"github.com/ossf/scorecard/checker"
+	"github.com/ossf/scorecard/v2/checker"
 )
 
 const CheckAutomaticDependencyUpdate = "Automatic-Dependency-Update"

checks/binary_artifact.go

@@ -21,8 +21,8 @@ import (
 	"github.com/h2non/filetype"
 	"github.com/h2non/filetype/types"
 
-	"github.com/ossf/scorecard/checker"
-	sce "github.com/ossf/scorecard/errors"
+	"github.com/ossf/scorecard/v2/checker"
+	sce "github.com/ossf/scorecard/v2/errors"
 )
 
 const CheckBinaryArtifacts string = "Binary-Artifacts"

checks/branch_protected.go

@@ -21,8 +21,8 @@ import (
 
 	"github.com/google/go-github/v32/github"
 
-	"github.com/ossf/scorecard/checker"
-	sce "github.com/ossf/scorecard/errors"
+	"github.com/ossf/scorecard/v2/checker"
+	sce "github.com/ossf/scorecard/v2/errors"
 )
 
 const (

checks/branch_protected_test.go

@@ -21,9 +21,9 @@ import (
 
 	"github.com/google/go-github/v32/github"
 
-	"github.com/ossf/scorecard/checker"
-	sce "github.com/ossf/scorecard/errors"
-	scut "github.com/ossf/scorecard/utests"
+	"github.com/ossf/scorecard/v2/checker"
+	sce "github.com/ossf/scorecard/v2/errors"
+	scut "github.com/ossf/scorecard/v2/utests"
 )
 
 type mockRepos struct {

checks/checkforcontent.go

@@ -19,8 +19,8 @@ import (
 	"path"
 	"strings"
 
-	"github.com/ossf/scorecard/checker"
-	sce "github.com/ossf/scorecard/errors"
+	"github.com/ossf/scorecard/v2/checker"
+	sce "github.com/ossf/scorecard/v2/errors"
 )
 
 // IsMatchingPath uses 'pattern' to shell-match the 'path' and its filename

checks/checkforfile.go

@@ -15,7 +15,7 @@
 package checks
 
 import (
-	"github.com/ossf/scorecard/checker"
+	"github.com/ossf/scorecard/v2/checker"
 )
 
 // CheckIfFileExists downloads the tar of the repository and calls the onFile() to check

checks/ci_tests.go

@@ -20,8 +20,8 @@ import (
 
 	"github.com/google/go-github/v32/github"
 
-	"github.com/ossf/scorecard/checker"
-	sce "github.com/ossf/scorecard/errors"
+	"github.com/ossf/scorecard/v2/checker"
+	sce "github.com/ossf/scorecard/v2/errors"
 )
 
 // States for which CI system is in use.

checks/cii_best_practices.go

@@ -21,8 +21,8 @@ import (
 	"net/http"
 	"strings"
 
-	"github.com/ossf/scorecard/checker"
-	sce "github.com/ossf/scorecard/errors"
+	"github.com/ossf/scorecard/v2/checker"
+	sce "github.com/ossf/scorecard/v2/errors"
 )
 
 // CheckCIIBestPractices is the registered name for CIIBestPractices.

checks/code_review.go

@@ -20,8 +20,8 @@ import (
 
 	"github.com/google/go-github/v32/github"
 
-	"github.com/ossf/scorecard/checker"
-	sce "github.com/ossf/scorecard/errors"
+	"github.com/ossf/scorecard/v2/checker"
+	sce "github.com/ossf/scorecard/v2/errors"
 )
 
 // CheckCodeReview is the registered name for DoesCodeReview.

checks/contributors.go

@@ -20,8 +20,8 @@ import (
 
 	"github.com/google/go-github/v32/github"
 
-	"github.com/ossf/scorecard/checker"
-	sce "github.com/ossf/scorecard/errors"
+	"github.com/ossf/scorecard/v2/checker"
+	sce "github.com/ossf/scorecard/v2/errors"
 )
 
 const (

checks/frozen_deps.go

@@ -22,8 +22,8 @@ import (
 	"github.com/moby/buildkit/frontend/dockerfile/parser"
 	"gopkg.in/yaml.v2"
 
-	"github.com/ossf/scorecard/checker"
-	sce "github.com/ossf/scorecard/errors"
+	"github.com/ossf/scorecard/v2/checker"
+	sce "github.com/ossf/scorecard/v2/errors"
 )
 
 // CheckFrozenDeps is the registered name for FrozenDeps.

checks/frozen_deps_test.go

@@ -19,9 +19,9 @@ import (
 	"io/ioutil"
 	"testing"
 
-	"github.com/ossf/scorecard/checker"
-	sce "github.com/ossf/scorecard/errors"
-	scut "github.com/ossf/scorecard/utests"
+	"github.com/ossf/scorecard/v2/checker"
+	sce "github.com/ossf/scorecard/v2/errors"
+	scut "github.com/ossf/scorecard/v2/utests"
 )
 
 func TestGithubWorkflowPinning(t *testing.T) {

checks/fuzzing.go

@@ -19,8 +19,8 @@ import (
 
 	"github.com/google/go-github/v32/github"
 
-	"github.com/ossf/scorecard/checker"
-	sce "github.com/ossf/scorecard/errors"
+	"github.com/ossf/scorecard/v2/checker"
+	sce "github.com/ossf/scorecard/v2/errors"
 )
 
 // CheckFuzzing is the registered name for Fuzzing.

checks/packaging.go

@@ -22,8 +22,8 @@ import (
 
 	"github.com/google/go-github/v32/github"
 
-	"github.com/ossf/scorecard/checker"
-	sce "github.com/ossf/scorecard/errors"
+	"github.com/ossf/scorecard/v2/checker"
+	sce "github.com/ossf/scorecard/v2/errors"
 )
 
 // CheckPackaging is the registered name for Packaging.

checks/permissions.go

@@ -20,8 +20,8 @@ import (
 
 	"gopkg.in/yaml.v2"
 
-	"github.com/ossf/scorecard/checker"
-	sce "github.com/ossf/scorecard/errors"
+	"github.com/ossf/scorecard/v2/checker"
+	sce "github.com/ossf/scorecard/v2/errors"
 )
 
 const CheckPermissions = "Token-Permissions"

checks/permissions_test.go

@@ -19,8 +19,8 @@ import (
 	"io/ioutil"
 	"testing"
 
-	"github.com/ossf/scorecard/checker"
-	scut "github.com/ossf/scorecard/utests"
+	"github.com/ossf/scorecard/v2/checker"
+	scut "github.com/ossf/scorecard/v2/utests"
 )
 
 //nolint

checks/pull_requests.go

@@ -20,8 +20,8 @@ import (
 
 	"github.com/google/go-github/v32/github"
 
-	"github.com/ossf/scorecard/checker"
-	sce "github.com/ossf/scorecard/errors"
+	"github.com/ossf/scorecard/v2/checker"
+	sce "github.com/ossf/scorecard/v2/errors"
 )
 
 // CheckPullRequests is the registered name for PullRequests.

checks/sast.go

@@ -19,8 +19,8 @@ import (
 
 	"github.com/google/go-github/v32/github"
 
-	"github.com/ossf/scorecard/checker"
-	sce "github.com/ossf/scorecard/errors"
+	"github.com/ossf/scorecard/v2/checker"
+	sce "github.com/ossf/scorecard/v2/errors"
 )
 
 // CheckSAST is the registered name for SAST.

checks/security_policy.go

@@ -17,8 +17,8 @@ package checks
 import (
 	"strings"
 
-	"github.com/ossf/scorecard/checker"
-	"github.com/ossf/scorecard/clients/githubrepo"
+	"github.com/ossf/scorecard/v2/checker"
+	"github.com/ossf/scorecard/v2/clients/githubrepo"
 )
 
 // CheckSecurityPolicy is the registred name for SecurityPolicy.

checks/shell_download_validate.go

@@ -26,8 +26,8 @@ import (
 
 	"mvdan.cc/sh/v3/syntax"
 
-	"github.com/ossf/scorecard/checker"
-	sce "github.com/ossf/scorecard/errors"
+	"github.com/ossf/scorecard/v2/checker"
+	sce "github.com/ossf/scorecard/v2/errors"
 )
 
 // List of interpreters.

checks/signed_releases.go

@@ -20,8 +20,8 @@ import (
 
 	"github.com/google/go-github/v32/github"
 
-	"github.com/ossf/scorecard/checker"
-	sce "github.com/ossf/scorecard/errors"
+	"github.com/ossf/scorecard/v2/checker"
+	sce "github.com/ossf/scorecard/v2/errors"
 )
 
 const (

checks/signed_tags.go

@@ -19,8 +19,8 @@ import (
 
 	"github.com/shurcooL/githubv4"
 
-	"github.com/ossf/scorecard/checker"
-	sce "github.com/ossf/scorecard/errors"
+	"github.com/ossf/scorecard/v2/checker"
+	sce "github.com/ossf/scorecard/v2/errors"
 )
 
 const (

checks/vulnerabilities.go

@@ -23,8 +23,8 @@ import (
 
 	"github.com/google/go-github/v32/github"
 
-	"github.com/ossf/scorecard/checker"
-	sce "github.com/ossf/scorecard/errors"
+	"github.com/ossf/scorecard/v2/checker"
+	sce "github.com/ossf/scorecard/v2/errors"
 )
 
 const (

clients/githubrepo/client.go

@@ -21,7 +21,7 @@ import (
 	"github.com/google/go-github/v32/github"
 	"github.com/shurcooL/githubv4"
 
-	"github.com/ossf/scorecard/clients"
+	"github.com/ossf/scorecard/v2/clients"
 )
 
 type Client struct {

clients/githubrepo/graphql.go

@@ -20,8 +20,8 @@ import (
 
 	"github.com/shurcooL/githubv4"
 
-	"github.com/ossf/scorecard/clients"
-	sce "github.com/ossf/scorecard/errors"
+	"github.com/ossf/scorecard/v2/clients"
+	sce "github.com/ossf/scorecard/v2/errors"
 )
 
 const (

cmd/root.go

@@ -32,12 +32,12 @@ import (
 	"github.com/spf13/cobra"
 	"go.uber.org/zap"
 
-	"github.com/ossf/scorecard/checker"
-	"github.com/ossf/scorecard/checks"
-	"github.com/ossf/scorecard/clients/githubrepo"
-	"github.com/ossf/scorecard/pkg"
-	"github.com/ossf/scorecard/repos"
-	"github.com/ossf/scorecard/roundtripper"
+	"github.com/ossf/scorecard/v2/checker"
+	"github.com/ossf/scorecard/v2/checks"
+	"github.com/ossf/scorecard/v2/clients/githubrepo"
+	"github.com/ossf/scorecard/v2/pkg"
+	"github.com/ossf/scorecard/v2/repos"
+	"github.com/ossf/scorecard/v2/roundtripper"
 )
 
 var (

cmd/serve.go

@@ -27,11 +27,11 @@ import (
 	"github.com/spf13/cobra"
 	"go.uber.org/zap"
 
-	"github.com/ossf/scorecard/checks"
-	"github.com/ossf/scorecard/clients/githubrepo"
-	"github.com/ossf/scorecard/pkg"
-	"github.com/ossf/scorecard/repos"
-	"github.com/ossf/scorecard/roundtripper"
+	"github.com/ossf/scorecard/v2/checks"
+	"github.com/ossf/scorecard/v2/clients/githubrepo"
+	"github.com/ossf/scorecard/v2/pkg"
+	"github.com/ossf/scorecard/v2/repos"
+	"github.com/ossf/scorecard/v2/roundtripper"
 )
 
 //nolint:gochecknoinits

cron/bq/main.go

@@ -21,8 +21,8 @@ import (
 	"strings"
 	"time"
 
-	"github.com/ossf/scorecard/cron/config"
-	"github.com/ossf/scorecard/cron/data"
+	"github.com/ossf/scorecard/v2/cron/config"
+	"github.com/ossf/scorecard/v2/cron/data"
 )
 
 type shardSummary struct {

cron/bq/transfer.go

@@ -22,7 +22,7 @@ import (
 
 	"cloud.google.com/go/bigquery"
 
-	"github.com/ossf/scorecard/cron/config"
+	"github.com/ossf/scorecard/v2/cron/config"
 )
 
 const partitionDateFormat = "20060102"

cron/controller/main.go

@@ -23,9 +23,9 @@ import (
 
 	"google.golang.org/protobuf/types/known/timestamppb"
 
-	"github.com/ossf/scorecard/cron/config"
-	"github.com/ossf/scorecard/cron/data"
-	"github.com/ossf/scorecard/cron/pubsub"
+	"github.com/ossf/scorecard/v2/cron/config"
+	"github.com/ossf/scorecard/v2/cron/data"
+	"github.com/ossf/scorecard/v2/cron/pubsub"
 )
 
 func PublishToRepoRequestTopic(ctx context.Context, iter data.Iterator, datetime time.Time) (int32, error) {

cron/data/add/main.go

@@ -19,8 +19,8 @@ import (
 	"fmt"
 	"os"
 
-	"github.com/ossf/scorecard/cron/data"
-	"github.com/ossf/scorecard/repos"
+	"github.com/ossf/scorecard/v2/cron/data"
+	"github.com/ossf/scorecard/v2/repos"
 )
 
 // Script to add new project repositories to the projects.csv file:

cron/data/add/main_test.go

@@ -21,8 +21,8 @@ import (
 	"github.com/google/go-cmp/cmp"
 	"github.com/google/go-cmp/cmp/cmpopts"
 
-	"github.com/ossf/scorecard/cron/data"
-	"github.com/ossf/scorecard/repos"
+	"github.com/ossf/scorecard/v2/cron/data"
+	"github.com/ossf/scorecard/v2/repos"
 )
 
 func isLessThanRepoURL(x, y repos.RepoURL) bool {

cron/data/blob.go

@@ -26,7 +26,7 @@ import (
 	// Needed to link in GCP drivers.
 	_ "gocloud.dev/blob/gcsblob"
 
-	"github.com/ossf/scorecard/cron/config"
+	"github.com/ossf/scorecard/v2/cron/config"
 )
 
 const (

cron/data/iterator.go

@@ -22,7 +22,7 @@ import (
 
 	"github.com/jszwec/csvutil"
 
-	"github.com/ossf/scorecard/repos"
+	"github.com/ossf/scorecard/v2/repos"
 )
 
 type Iterator interface {

cron/data/iterator_test.go

@@ -21,7 +21,7 @@ import (
 
 	"github.com/google/go-cmp/cmp"
 
-	"github.com/ossf/scorecard/repos"
+	"github.com/ossf/scorecard/v2/repos"
 )
 
 type outcome struct {

cron/data/request.proto

@@ -18,7 +18,7 @@ package ossf.scorecard.cron.data;
 
 import "google/protobuf/timestamp.proto";
 
-option go_package = "github.com/ossf/scorecard/cron/data";
+option go_package = "github.com/ossf/scorecard/v2/cron/data";
 
 message ScorecardBatchRequest {
   repeated string repos = 1;

cron/data/update/dependency.go

@@ -30,8 +30,8 @@ import (
 	"github.com/google/go-github/v33/github"
 	"golang.org/x/tools/go/vcs"
 
-	"github.com/ossf/scorecard/cron/data"
-	"github.com/ossf/scorecard/repos"
+	"github.com/ossf/scorecard/v2/cron/data"
+	"github.com/ossf/scorecard/v2/repos"
 )
 
 var (

cron/data/update/main.go

@@ -18,7 +18,7 @@ import (
 	"bytes"
 	"os"
 
-	"github.com/ossf/scorecard/cron/data"
+	"github.com/ossf/scorecard/v2/cron/data"
 )
 
 // Updates projects repositories with a projects dependencies.

cron/data/validate/main.go

@@ -18,7 +18,7 @@ import (
 	"log"
 	"os"
 
-	"github.com/ossf/scorecard/cron/data"
+	"github.com/ossf/scorecard/v2/cron/data"
 )
 
 // Validates data.Iterator used by production PubSub cron job.

cron/data/writer.go

@@ -22,7 +22,7 @@ import (
 
 	"github.com/jszwec/csvutil"
 
-	"github.com/ossf/scorecard/repos"
+	"github.com/ossf/scorecard/v2/repos"
 )
 
 func repoFormatFromRepoURL(repoURLs []repos.RepoURL) []repoFormat {

cron/data/writer_test.go

@@ -18,7 +18,7 @@ import (
 	"bytes"
 	"testing"
 
-	"github.com/ossf/scorecard/repos"
+	"github.com/ossf/scorecard/v2/repos"
 )
 
 func TestCsvWriter(t *testing.T) {

cron/monitoring/exporter.go

@@ -23,7 +23,7 @@ import (
 	"contrib.go.opencensus.io/exporter/stackdriver/monitoredresource/gcp"
 	"go.opencensus.io/stats/view"
 
-	"github.com/ossf/scorecard/cron/config"
+	"github.com/ossf/scorecard/v2/cron/config"
 )
 
 var errorUndefinedExporter = errors.New("unsupported exporterType")

cron/pubsub/publisher.go

@@ -28,7 +28,7 @@ import (
 	_ "gocloud.dev/pubsub/gcppubsub"
 	"google.golang.org/protobuf/encoding/protojson"
 
-	"github.com/ossf/scorecard/cron/data"
+	"github.com/ossf/scorecard/v2/cron/data"
 )
 
 var errorPublish = errors.New("total errors when publishing")

cron/pubsub/publisher_test.go

@@ -21,7 +21,7 @@ import (
 
 	"gocloud.dev/pubsub"
 
-	"github.com/ossf/scorecard/cron/data"
+	"github.com/ossf/scorecard/v2/cron/data"
 )
 
 type mockSucceedTopic struct{}

cron/pubsub/subscriber.go

@@ -21,7 +21,7 @@ import (
 
 	"google.golang.org/protobuf/encoding/protojson"
 
-	"github.com/ossf/scorecard/cron/data"
+	"github.com/ossf/scorecard/v2/cron/data"
 )
 
 // ErrorInParse indicates there was an error while unmarshalling the protocol buffer message.

cron/pubsub/subscriber_gcs.go

@@ -24,7 +24,7 @@ import (
 	pubsub "cloud.google.com/go/pubsub/apiv1"
 	pubsubpb "google.golang.org/genproto/googleapis/pubsub/v1"
 
-	"github.com/ossf/scorecard/cron/data"
+	"github.com/ossf/scorecard/v2/cron/data"
 )
 
 const (

cron/pubsub/subscriber_gocloud.go

@@ -24,7 +24,7 @@ import (
 	// Needed to link in GCP drivers.
 	_ "gocloud.dev/pubsub/gcppubsub"
 
-	"github.com/ossf/scorecard/cron/data"
+	"github.com/ossf/scorecard/v2/cron/data"
 )
 
 type receiver interface {

cron/pubsub/subscriber_gocloud_test.go

@@ -23,7 +23,7 @@ import (
 	"google.golang.org/protobuf/encoding/protojson"
 	"google.golang.org/protobuf/proto"
 
-	"github.com/ossf/scorecard/cron/data"
+	"github.com/ossf/scorecard/v2/cron/data"
 )
 
 type mockReceiver struct {

cron/worker/main.go

@@ -31,18 +31,18 @@ import (
 	"go.uber.org/zap"
 	"go.uber.org/zap/zapcore"
 
-	"github.com/ossf/scorecard/checker"
-	"github.com/ossf/scorecard/checks"
-	"github.com/ossf/scorecard/clients"
-	"github.com/ossf/scorecard/clients/githubrepo"
-	"github.com/ossf/scorecard/cron/config"
-	"github.com/ossf/scorecard/cron/data"
-	"github.com/ossf/scorecard/cron/monitoring"
-	"github.com/ossf/scorecard/cron/pubsub"
-	"github.com/ossf/scorecard/pkg"
-	"github.com/ossf/scorecard/repos"
-	"github.com/ossf/scorecard/roundtripper"
-	"github.com/ossf/scorecard/stats"
+	"github.com/ossf/scorecard/v2/checker"
+	"github.com/ossf/scorecard/v2/checks"
+	"github.com/ossf/scorecard/v2/clients"
+	"github.com/ossf/scorecard/v2/clients/githubrepo"
+	"github.com/ossf/scorecard/v2/cron/config"
+	"github.com/ossf/scorecard/v2/cron/data"
+	"github.com/ossf/scorecard/v2/cron/monitoring"
+	"github.com/ossf/scorecard/v2/cron/pubsub"
+	"github.com/ossf/scorecard/v2/pkg"
+	"github.com/ossf/scorecard/v2/repos"
+	"github.com/ossf/scorecard/v2/roundtripper"
+	"github.com/ossf/scorecard/v2/stats"
 )
 
 var errIgnore *clients.ErrRepoUnavailable

e2e/active_test.go

@@ -21,9 +21,9 @@ import (
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/gomega"
 
-	"github.com/ossf/scorecard/checker"
-	"github.com/ossf/scorecard/checks"
-	scut "github.com/ossf/scorecard/utests"
+	"github.com/ossf/scorecard/v2/checker"
+	"github.com/ossf/scorecard/v2/checks"
+	scut "github.com/ossf/scorecard/v2/utests"
 )
 
 var _ = Describe("E2E TEST:Active", func() {

e2e/automatic_deps_test.go

@@ -21,10 +21,10 @@ import (
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/gomega"
 
-	"github.com/ossf/scorecard/checker"
-	"github.com/ossf/scorecard/checks"
-	"github.com/ossf/scorecard/clients/githubrepo"
-	scut "github.com/ossf/scorecard/utests"
+	"github.com/ossf/scorecard/v2/checker"
+	"github.com/ossf/scorecard/v2/checks"
+	"github.com/ossf/scorecard/v2/clients/githubrepo"
+	scut "github.com/ossf/scorecard/v2/utests"
 )
 
 // TODO: use dedicated repo that don't change.

e2e/binary_artifacts_test.go

@@ -21,10 +21,10 @@ import (
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/gomega"
 
-	"github.com/ossf/scorecard/checker"
-	"github.com/ossf/scorecard/checks"
-	"github.com/ossf/scorecard/clients/githubrepo"
-	scut "github.com/ossf/scorecard/utests"
+	"github.com/ossf/scorecard/v2/checker"
+	"github.com/ossf/scorecard/v2/checks"
+	"github.com/ossf/scorecard/v2/clients/githubrepo"
+	scut "github.com/ossf/scorecard/v2/utests"
 )
 
 // TODO: use dedicated repo that don't change.

e2e/branchprotection_test.go

@@ -20,10 +20,10 @@ import (
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/gomega"
 
-	"github.com/ossf/scorecard/checker"
-	"github.com/ossf/scorecard/checks"
-	sce "github.com/ossf/scorecard/errors"
-	scut "github.com/ossf/scorecard/utests"
+	"github.com/ossf/scorecard/v2/checker"
+	"github.com/ossf/scorecard/v2/checks"
+	sce "github.com/ossf/scorecard/v2/errors"
+	scut "github.com/ossf/scorecard/v2/utests"
 )
 
 var _ = Describe("E2E TEST:Branch Protection", func() {

e2e/ci_tests_test.go

@@ -20,9 +20,9 @@ import (
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/gomega"
 
-	"github.com/ossf/scorecard/checker"
-	"github.com/ossf/scorecard/checks"
-	scut "github.com/ossf/scorecard/utests"
+	"github.com/ossf/scorecard/v2/checker"
+	"github.com/ossf/scorecard/v2/checks"
+	scut "github.com/ossf/scorecard/v2/utests"
 )
 
 var _ = Describe("E2E TEST:CITests", func() {

e2e/cii_best_practices_test.go

@@ -20,9 +20,9 @@ import (
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/gomega"
 
-	"github.com/ossf/scorecard/checker"
-	"github.com/ossf/scorecard/checks"
-	scut "github.com/ossf/scorecard/utests"
+	"github.com/ossf/scorecard/v2/checker"
+	"github.com/ossf/scorecard/v2/checks"
+	scut "github.com/ossf/scorecard/v2/utests"
 )
 
 var _ = Describe("E2E TEST:CIIBestPractices", func() {

e2e/code_review_test.go

@@ -21,10 +21,10 @@ import (
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/gomega"
 
-	"github.com/ossf/scorecard/checker"
-	"github.com/ossf/scorecard/checks"
-	"github.com/ossf/scorecard/clients/githubrepo"
-	scut "github.com/ossf/scorecard/utests"
+	"github.com/ossf/scorecard/v2/checker"
+	"github.com/ossf/scorecard/v2/checks"
+	"github.com/ossf/scorecard/v2/clients/githubrepo"
+	scut "github.com/ossf/scorecard/v2/utests"
 )
 
 // TODO: use dedicated repo that don't change.

e2e/contributors_test.go

@@ -21,9 +21,9 @@ import (
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/gomega"
 
-	"github.com/ossf/scorecard/checker"
-	"github.com/ossf/scorecard/checks"
-	scut "github.com/ossf/scorecard/utests"
+	"github.com/ossf/scorecard/v2/checker"
+	"github.com/ossf/scorecard/v2/checks"
+	scut "github.com/ossf/scorecard/v2/utests"
 )
 
 var _ = Describe("E2E TEST:Contributors", func() {

e2e/e2e_suite_test.go

@@ -26,7 +26,7 @@ import (
 	"github.com/shurcooL/githubv4"
 	"go.uber.org/zap"
 
-	"github.com/ossf/scorecard/roundtripper"
+	"github.com/ossf/scorecard/v2/roundtripper"
 )
 
 var (

e2e/frozen_deps_test.go

@@ -20,10 +20,10 @@ import (
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/gomega"
 
-	"github.com/ossf/scorecard/checker"
-	"github.com/ossf/scorecard/checks"
-	"github.com/ossf/scorecard/clients/githubrepo"
-	scut "github.com/ossf/scorecard/utests"
+	"github.com/ossf/scorecard/v2/checker"
+	"github.com/ossf/scorecard/v2/checks"
+	"github.com/ossf/scorecard/v2/clients/githubrepo"
+	scut "github.com/ossf/scorecard/v2/utests"
 )
 
 // TODO: use dedicated repo that don't change.

e2e/fuzzing_test.go

@@ -20,9 +20,9 @@ import (
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/gomega"
 
-	"github.com/ossf/scorecard/checker"
-	"github.com/ossf/scorecard/checks"
-	scut "github.com/ossf/scorecard/utests"
+	"github.com/ossf/scorecard/v2/checker"
+	"github.com/ossf/scorecard/v2/checks"
+	scut "github.com/ossf/scorecard/v2/utests"
 )
 
 var _ = Describe("E2E TEST:Fuzzing", func() {

e2e/packaging_test.go

@@ -20,9 +20,9 @@ import (
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/gomega"
 
-	"github.com/ossf/scorecard/checker"
-	"github.com/ossf/scorecard/checks"
-	scut "github.com/ossf/scorecard/utests"
+	"github.com/ossf/scorecard/v2/checker"
+	"github.com/ossf/scorecard/v2/checks"
+	scut "github.com/ossf/scorecard/v2/utests"
 )
 
 var _ = Describe("E2E TEST:Packaging", func() {

e2e/pull_requests_test.go

@@ -20,9 +20,9 @@ import (
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/gomega"
 
-	"github.com/ossf/scorecard/checker"
-	"github.com/ossf/scorecard/checks"
-	scut "github.com/ossf/scorecard/utests"
+	"github.com/ossf/scorecard/v2/checker"
+	"github.com/ossf/scorecard/v2/checks"
+	scut "github.com/ossf/scorecard/v2/utests"
 )
 
 var _ = Describe("E2E TEST:PullRequests", func() {

e2e/sast_test.go

@@ -20,9 +20,9 @@ import (
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/gomega"
 
-	"github.com/ossf/scorecard/checker"
-	"github.com/ossf/scorecard/checks"
-	scut "github.com/ossf/scorecard/utests"
+	"github.com/ossf/scorecard/v2/checker"
+	"github.com/ossf/scorecard/v2/checks"
+	scut "github.com/ossf/scorecard/v2/utests"
 )
 
 var _ = Describe("E2E TEST:SAST", func() {

e2e/security_policy_test.go

@@ -20,10 +20,10 @@ import (
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/gomega"
 
-	"github.com/ossf/scorecard/checker"
-	"github.com/ossf/scorecard/checks"
-	"github.com/ossf/scorecard/clients/githubrepo"
-	scut "github.com/ossf/scorecard/utests"
+	"github.com/ossf/scorecard/v2/checker"
+	"github.com/ossf/scorecard/v2/checks"
+	"github.com/ossf/scorecard/v2/clients/githubrepo"
+	scut "github.com/ossf/scorecard/v2/utests"
 )
 
 var _ = Describe("E2E TEST:SecurityPolicy", func() {

e2e/signedreleases_test.go

@@ -20,9 +20,9 @@ import (
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/gomega"
 
-	"github.com/ossf/scorecard/checker"
-	"github.com/ossf/scorecard/checks"
-	scut "github.com/ossf/scorecard/utests"
+	"github.com/ossf/scorecard/v2/checker"
+	"github.com/ossf/scorecard/v2/checks"
+	scut "github.com/ossf/scorecard/v2/utests"
 )
 
 var _ = Describe("E2E TEST:Signedreleases", func() {

e2e/signedtags_test.go

@@ -20,9 +20,9 @@ import (
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/gomega"
 
-	"github.com/ossf/scorecard/checker"
-	"github.com/ossf/scorecard/checks"
-	scut "github.com/ossf/scorecard/utests"
+	"github.com/ossf/scorecard/v2/checker"
+	"github.com/ossf/scorecard/v2/checks"
+	scut "github.com/ossf/scorecard/v2/utests"
 )
 
 var _ = Describe("E2E TEST:Signedtags", func() {

e2e/vulnerabilities_test.go

@@ -21,9 +21,9 @@ import (
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/gomega"
 
-	"github.com/ossf/scorecard/checker"
-	"github.com/ossf/scorecard/checks"
-	scut "github.com/ossf/scorecard/utests"
+	"github.com/ossf/scorecard/v2/checker"
+	"github.com/ossf/scorecard/v2/checks"
+	scut "github.com/ossf/scorecard/v2/utests"
 )
 
 var _ = Describe("E2E TEST:Vulnerabilities", func() {

errors/errors.md

@@ -1,7 +1,7 @@
 # How to handle errors
 
 ```golang
-import sce "github.com/ossf/scorecard/errors"
+import sce "github.com/ossf/scorecard/v2/errors"
 
 // Public errors are defined in errors/public.go and are exposed to callers.
 // Internal errors are defined in checks/errors.go. Their names start with errInternalXXX
@@ -25,4 +25,4 @@ err := dependency.apiCall()
 if err != nil {
     return sce.Create(sce.ErrScorecardInternal, fmt.Sprintf("dependency.apiCall: %v", err))
 }
-```
+```

go.mod

@@ -1,4 +1,4 @@
-module github.com/ossf/scorecard
+module github.com/ossf/scorecard/v2
 
 go 1.16
 
@@ -13,7 +13,6 @@ require (
 	github.com/google/go-cmp v0.5.6
 	github.com/google/go-github/v32 v32.1.0
 	github.com/google/go-github/v33 v33.0.0
-	github.com/google/go-querystring v1.1.0 // indirect
 	github.com/h2non/filetype v1.1.1
 	github.com/jszwec/csvutil v1.5.0
 	github.com/moby/buildkit v0.8.3
@@ -26,11 +25,8 @@ require (
 	github.com/shurcooL/graphql v0.0.0-20200928012149-18c5c3165e3a // indirect
 	github.com/spf13/cobra v1.2.1
 	go.opencensus.io v0.23.0
-	go.uber.org/multierr v1.7.0 // indirect
 	go.uber.org/zap v1.18.1
 	gocloud.dev v0.23.0
-	golang.org/x/crypto v0.0.0-20210513164829-c07d793c2f9a // indirect
-	golang.org/x/net v0.0.0-20210510120150-4163338589ed // indirect
 	golang.org/x/tools v0.1.5
 	google.golang.org/genproto v0.0.0-20210707164411-8c882eb9abba
 	google.golang.org/protobuf v1.27.1

go.sum

@@ -643,9 +643,8 @@ github.com/google/go-github/v32 v32.1.0 h1:GWkQOdXqviCPx7Q7Fj+KyPoGm4SwHRh8rheoP
 github.com/google/go-github/v32 v32.1.0/go.mod h1:rIEpZD9CTDQwDK9GDrtMTycQNA4JU3qBsCizh3q2WCI=
 github.com/google/go-github/v33 v33.0.0 h1:qAf9yP0qc54ufQxzwv+u9H0tiVOnPJxo0lI/JXqw3ZM=
 github.com/google/go-github/v33 v33.0.0/go.mod h1:GMdDnVZY/2TsWgp/lkYnpSAh6TrzhANBBwm6k6TTEXg=
+github.com/google/go-querystring v1.0.0 h1:Xkwi/a1rcvNg1PPYe5vI8GbeBY/jrVuDX5ASuANWTrk=
 github.com/google/go-querystring v1.0.0/go.mod h1:odCYkC5MyYFN7vkCjXpyrEuKhc/BUO6wN/zVPAxq5ck=
-github.com/google/go-querystring v1.1.0 h1:AnCroh3fv4ZBgVIf1Iwtovgjaw/GiKJo8M8yD/fhyJ8=
-github.com/google/go-querystring v1.1.0/go.mod h1:Kcdr2DB4koayq7X8pmAG4sNG59So17icRSOU623lUBU=
 github.com/google/go-replayers/grpcreplay v0.1.0/go.mod h1:8Ig2Idjpr6gifRd6pNVggX6TC1Zw6Jx74AKp7QNH2QE=
 github.com/google/go-replayers/grpcreplay v1.0.0 h1:B5kVOzJ1hBgnevTgIWhSTatQ3608yu/2NnU0Ta1d0kY=
 github.com/google/go-replayers/grpcreplay v1.0.0/go.mod h1:8Ig2Idjpr6gifRd6pNVggX6TC1Zw6Jx74AKp7QNH2QE=
@@ -1407,9 +1406,8 @@ go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/
 go.uber.org/multierr v1.3.0/go.mod h1:VgVr7evmIr6uPjLBxg28wmKNXyqE9akIJ5XnfpiKl+4=
 go.uber.org/multierr v1.4.0/go.mod h1:VgVr7evmIr6uPjLBxg28wmKNXyqE9akIJ5XnfpiKl+4=
 go.uber.org/multierr v1.5.0/go.mod h1:FeouvMocqHpRaaGuG9EjoKcStLC43Zu/fmqdUMPcKYU=
+go.uber.org/multierr v1.6.0 h1:y6IPFStTAIT5Ytl7/XYmHvzXQ7S3g/IeZW9hyZ5thw4=
 go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU=
-go.uber.org/multierr v1.7.0 h1:zaiO/rmgFjbmCXdSYJWQcdvOCsthmdaHfr3Gm2Kx4Ec=
-go.uber.org/multierr v1.7.0/go.mod h1:7EAYxJLBy9rStEaz58O2t4Uvip6FSURkq8/ppBp95ak=
 go.uber.org/tools v0.0.0-20190618225709-2cfd321de3ee/go.mod h1:vJERXedbb3MVM5f9Ejo0C68/HhF8uaILCdgjnY+goOA=
 go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
 go.uber.org/zap v1.13.0/go.mod h1:zwrFLgMcdUuIBviXEYEH1YKNaOBnKXsx2IPda5bBwHM=
@@ -1448,9 +1446,8 @@ golang.org/x/crypto v0.0.0-20201117144127-c1f2f97bffc9/go.mod h1:jdWPYTVW3xRLrWP
 golang.org/x/crypto v0.0.0-20201221181555-eec23a3978ad/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=
 golang.org/x/crypto v0.0.0-20210322153248-0c34fe9e7dc2/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
 golang.org/x/crypto v0.0.0-20210421170649-83a5a9bb288b/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
+golang.org/x/crypto v0.0.0-20210506145944-38f3c27a63bf h1:B2n+Zi5QeYRDAEodEu72OS36gmTWjgpXr2+cWcBW90o=
 golang.org/x/crypto v0.0.0-20210506145944-38f3c27a63bf/go.mod h1:P+XmwS30IXTQdn5tA2iutPOUgjI07+tq3H3K9MVA1s8=
-golang.org/x/crypto v0.0.0-20210513164829-c07d793c2f9a h1:kr2P4QFmQr29mSLA43kwrOcgcReGTfbE9N577tCTuBc=
-golang.org/x/crypto v0.0.0-20210513164829-c07d793c2f9a/go.mod h1:P+XmwS30IXTQdn5tA2iutPOUgjI07+tq3H3K9MVA1s8=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190125153040-c74c464bbbf2/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
@@ -1556,9 +1553,8 @@ golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96b
 golang.org/x/net v0.0.0-20210420210106-798c2154c571/go.mod h1:72T/g9IO56b78aLF+1Kcs5dz7/ng1VjMUvfKvpfy+jM=
 golang.org/x/net v0.0.0-20210428140749-89ef3d95e781/go.mod h1:OJAsFXCWl8Ukc7SiCT/9KSuxbyM7479/AVlXFRxuMCk=
 golang.org/x/net v0.0.0-20210503060351-7fd8e65b6420/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.0.0-20210505214959-0714010a04ed h1:V9kAVxLvz1lkufatrpHuUVyJ/5tR3Ms7rk951P4mI98=
 golang.org/x/net v0.0.0-20210505214959-0714010a04ed/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20210510120150-4163338589ed h1:p9UgmWI9wKpfYmgaV/IZKGdXc5qEK45tDwwwDyjS26I=
-golang.org/x/net v0.0.0-20210510120150-4163338589ed/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/oauth2 v0.0.0-20180724155351-3d292e4d0cdc/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20181017192945-9dcd33a902f4/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=

main.go

@@ -14,7 +14,7 @@
 
 package main
 
-import "github.com/ossf/scorecard/cmd"
+import "github.com/ossf/scorecard/v2/cmd"
 
 func main() {
 	cmd.Execute()

pkg/scorecard.go

@@ -26,10 +26,10 @@ import (
 	opencensusstats "go.opencensus.io/stats"
 	"go.opencensus.io/tag"
 
-	"github.com/ossf/scorecard/checker"
-	"github.com/ossf/scorecard/clients"
-	"github.com/ossf/scorecard/repos"
-	"github.com/ossf/scorecard/stats"
+	"github.com/ossf/scorecard/v2/checker"
+	"github.com/ossf/scorecard/v2/clients"
+	"github.com/ossf/scorecard/v2/repos"
+	"github.com/ossf/scorecard/v2/stats"
 )
 
 func logStats(ctx context.Context, startTime time.Time) {

pkg/scorecard_result.go

@@ -27,7 +27,7 @@ import (
 	"github.com/olekukonko/tablewriter"
 	"go.uber.org/zap/zapcore"
 
-	"github.com/ossf/scorecard/checker"
+	"github.com/ossf/scorecard/v2/checker"
 )
 
 type ScorecardResult struct {

roundtripper/census.go

@@ -23,7 +23,7 @@ import (
 	opencensusstats "go.opencensus.io/stats"
 	"go.opencensus.io/tag"
 
-	"github.com/ossf/scorecard/stats"
+	"github.com/ossf/scorecard/v2/stats"
 )
 
 func MakeCensusTransport(innerTransport http.RoundTripper) http.RoundTripper {

roundtripper/roundtripper.go

@@ -25,7 +25,7 @@ import (
 	"github.com/bradleyfalzon/ghinstallation"
 	"go.uber.org/zap"
 
-	"github.com/ossf/scorecard/clients/githubrepo"
+	"github.com/ossf/scorecard/v2/clients/githubrepo"
 )
 
 // GithubAuthTokens are for making requests to GiHub's API.

utests/utlib.go

@@ -19,7 +19,7 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/ossf/scorecard/checker"
+	"github.com/ossf/scorecard/v2/checker"
 )
 
 func validateDetailTypes(messages []checker.CheckDetail, nw, ni, nd int) bool {