Retrieve a GitHub repository's published OpenSSF Scorecard score via the public Scorecard REST API without running a local scan

Verified steps

1. Send a GET request to https://api.securityscorecards.dev/projects/github.com/<owner>/<repo> to retrieve the most recent published Scorecard result for that repository.
2. Parse the JSON response's overall score plus the per-check array (each check has a name, score, and reason) to see which specific practices — e.g. Pinned-Dependencies, Token-Permissions, Branch-Protection — drove the score.
3. Note the response only covers repositories included in OpenSSF's periodic batch scan of tracked open-source projects — a repository outside that set will not have a published entry.
4. Cache or rate-limit calls in dependency-selection tooling (e.g. a CI gate evaluating a new dependency) rather than calling the API on every build, since the underlying data only refreshes on the batch scan's cadence, not in real time.
5. For repositories not covered by the public batch scan, run the scorecard CLI or GitHub Action directly against the repo instead of relying on the API.