query rebuild results and renovate pr integration

Hi,

I'm a big fan of the work that is done in reproducible-central and the idea of reproducible builds in general. I created a small project for an initial integration of reproducible-central into Renovate PRs.

Link: https://github.com/PhilippHeuer/jvm-repo-rebuild-index (written in Go) Example PR: https://github.com/PhilippHeuer/renovate-test/pull/8

Configuration:

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "packageRules": [
    {
      "matchDatasources": ["maven"],
      "prBodyDefinitions": {
        "Reproducible": "{{#if newVersion}}[![Reproducible Builds](https://img.shields.io/endpoint?url=https://jvm-rebuild.philippheuer.de/v1/badge/reproducible/maven/{{depName}}/{{{newVersion}}}?theme=renovate)](https://jvm-rebuild.philippheuer.de/v1/redirect/reproducible/maven/{{depName}}/{{{newVersion}}}){{/if}}"
      },
      "prBodyColumns": [
        "Package",
        "Change",
        "Adoption",
        "Passing",
        "Reproducible"
      ]
    }
  ]
}

Note: This is the first beta and the format of the json files on gh pages may be changed, but the api endpoints used in the PRs will remain stable.

The objective of this project was to:

provide a way to query the reproducibility status of maven artifacts by group/artifact/version (by maven coordinates)
show a dynamic badge with the result for specific dependency versions (project missing, verification pending, reproducible, not reproducible)
redirect from the PR badge to the project readme in the reproducible-central

This first version generates static json files for all projects in reproducible-central and serves them via GitHub pages. Additionally, it contains a few api endpoints for the dynamic PR badge. (selfhosted, requires logic so static json doesn't work)

I think it would be awesome to have an official API to integrate jvm-repo-rebuild results into Renovate, Dependabot, ... (this could enable a native integrations in the future)

Maybe this project can serve as a starting point for that (either as reference or to mature into something official), I would love to hear your thoughts on this project / idea.

jvm-repo-rebuild / reproducible-central

query rebuild results and renovate pr integration #421