fix(materials): only annotate Scorecard score when present

Address review feedback: the aggregate score annotation was set
unconditionally, so a nonconformant report missing "score" would be
misrepresented as score 0 under --no-strict-validation. Make the score
field a pointer so an absent score is distinguishable from a real 0.0,
and only set the annotation when present.

Assisted-by: Claude Code
Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev>

Chainloop-Trace-Sessions: 234a5dc3-baba-4c3d-be42-dbabf15c5487

Author: migmartri

pkg/attestation/crafter/materials/scorecard.go

@@ -40,8 +40,10 @@ type OSSFScorecardCrafter struct {
 // detection and annotations. Deep structural validation is delegated to the
 // embedded JSON Schema via schemavalidators.ValidateOSSFScorecard.
 type scorecardReport struct {
-	Date  string  `json:"date"`
-	Score float64 `json:"score"`
+	Date string `json:"date"`
+	// Score is a pointer so an absent aggregate score is distinguishable from a
+	// legitimate 0.0, avoiding misrepresenting a nonconformant report as score 0.
+	Score *float64 `json:"score"`
 	Repo  struct {
 		Name   string `json:"name"`
 		Commit string `json:"commit"`
@@ -142,5 +144,7 @@ func (i *OSSFScorecardCrafter) injectAnnotations(m *api.Attestation_Material, re
 		m.Annotations[AnnotationToolVersionKey] = report.Scorecard.Version
 	}
 
-	m.Annotations["chainloop.material.scorecard.score"] = strconv.FormatFloat(report.Score, 'f', -1, 64)
+	if report.Score != nil {
+		m.Annotations["chainloop.material.scorecard.score"] = strconv.FormatFloat(*report.Score, 'f', -1, 64)
+	}
 }

pkg/attestation/crafter/materials/scorecard_test.go

@@ -151,9 +151,11 @@ func TestOSSFScorecardCrafter_Craft(t *testing.T) {
 // rejects arbitrary JSON, so non-Scorecard files are not misclassified.
 func TestOSSFScorecardCrafter_Craft_NoStrictValidation(t *testing.T) {
 	testCases := []struct {
-		name     string
-		filePath string
-		wantErr  string
+		name string
+		// noScoreAnnotation asserts the score annotation is absent (report had no score).
+		filePath          string
+		wantErr           string
+		noScoreAnnotation bool
 	}{
 		{
 			name:     "non-scorecard json still rejected",
@@ -164,6 +166,11 @@ func TestOSSFScorecardCrafter_Craft_NoStrictValidation(t *testing.T) {
 			name:     "valid scorecard accepted",
 			filePath: "./testdata/scorecard-chainloop.json",
 		},
+		{
+			name:              "report without score is not annotated as score 0",
+			filePath:          "./testdata/scorecard-no-score.json",
+			noScoreAnnotation: true,
+		},
 	}
 
 	schema := &contractAPI.CraftingSchema_Material{
@@ -184,13 +191,17 @@ func TestOSSFScorecardCrafter_Craft_NoStrictValidation(t *testing.T) {
 			crafter, err := materials.NewOSSFScorecardCrafter(schema, backend, &l, materials.WithOSSFScorecardNoStrictValidation(true))
 			require.NoError(t, err)
 
-			_, err = crafter.Craft(context.TODO(), tc.filePath)
+			got, err := crafter.Craft(context.TODO(), tc.filePath)
 			if tc.wantErr != "" {
 				assert.ErrorContains(t, err, tc.wantErr)
 				return
 			}
 
 			require.NoError(t, err)
+			if tc.noScoreAnnotation {
+				_, ok := got.Annotations["chainloop.material.scorecard.score"]
+				assert.False(t, ok, "score annotation should be absent when report has no score")
+			}
 		})
 	}
 }

pkg/attestation/crafter/materials/testdata/scorecard-no-score.json

@@ -0,0 +1,10 @@
+{
+  "date": "2026-06-15T14:27:17+02:00",
+  "repo": { "name": "github.com/chainloop-dev/chainloop", "commit": "892e78c" },
+  "scorecard": { "version": "v5.5.0", "commit": "c395761" },
+  "checks": [
+    { "details": null, "score": 10, "reason": "license file detected", "name": "License",
+      "documentation": { "url": "https://example.com", "short": "x" } }
+  ],
+  "metadata": null
+}