npm-health: Implement data collection and metrics computation pipeline(s)

[pombredanne]

I want to collect specific data in ScanCode.io using GrimoireLab using a ScanCode.io pipeline.

The outcome should be new ScanCode.io pipeline(s) to download and/or clone code and collect metrics, by orchestrating the execution of AboutCode, GrimoireLab, and other open source tools. Collected data is stored for further metric computations.

The high level flow would be:

1. Through a PurlDB API endpoint, the user requests metric scoring for a PURL
2. If the the package has been analyzed already, the data should be retrieved from the PurlDB DB and returned
3. Otherwise, PurlDB queues (or run) a scancode.io data collection/metric computation scoring pipeline
4. The pipeline collects the source/binary/git repos for the PURL
5. Then does it magic in GrimoireLab
6. The GrimoireLab analysis is returned somehow (webhook? polling? direct code integration in SCIO?)
7. PurlDB gets the data back, saves it in its DB and return the results

I suggest we implement a middle out strategy, starting with Grimoire, to ScanCode.io, to PurlDB:

• npm-health: Create a ScanCode.io pipeline to integrate Grimoire #2168
• npm-health: Implement collection and metrics in GrimoireLab, including the score calculation #2167
• npm-health: Extend PurlDB with a new REST API for health data metrics and scores purldb#869

Questions:

• is the PurlDB API call returning immediately (and run in the background) or wait synchronously? (NB: We have similar pattern for the on-demand scancode scans in the API already)
• what if the analysis is stale and 3 months old?