feat(scorecard): Implement baseUrl for fetching openssf data by alizard0 · Pull Request #2301 · redhat-developer/rhdh-plugins

alizard0 · 2026-02-10T10:26:37Z

Hey, I just made a Pull Request!

Remove abstract metric providers
Left only OpenSSF metric provider
Simplied the usage of the openssf client by fetching scorecards only using a baseUrl

✔️ Checklist

A changeset describing the change and affected packages. (more info)
Added or Updated documentation
Tests for new functionality and regression tests for bug fixes
Screenshots attached (for UI changes)

…nd simplied the usage of the openssf client by fetching scorecards only using a baseUrl

rhdh-gh-app · 2026-02-10T10:26:58Z

Missing Changesets

The following package(s) are changed by this PR but do not have a changeset:

@red-hat-developer-hub/backstage-plugin-scorecard-backend-module-openssf

See CONTRIBUTING.md for more information about how to add changesets.

Changed Packages

Package Name	Package Path	Changeset Bump	Current Version
@red-hat-developer-hub/backstage-plugin-scorecard-backend-module-openssf	workspaces/scorecard/plugins/scorecard-backend-module-openssf	none	`v0.1.5`

…interface, refactored tests

…ecard

alizard0 · 2026-02-11T14:26:00Z

Testing image, it loads all openssf metrics using baseUrl component annotation.

dzemanov · 2026-02-12T15:09:45Z

workspaces/scorecard/plugins/scorecard-backend-module-openssf/src/clients/OpenSSFClient.ts

-  async getScorecard(owner: string, repo: string): Promise<OpenSSFResponse> {
-    const apiUrl = `${this.baseUrl}/${this.gitServiceHost}/${owner}/${repo}`;
+  async getScorecard(entity: Entity): Promise<OpenSSFResponse> {
+    const baseUrl = entity.metadata.annotations?.['openssf/baseUrl'] ?? '';


I would rather take baseUrl from app-config of openssf. @christoph-jerolimov WDYT?

As we spoke earlier (in our wg), the idea of having it inside the component is to be able to have a different URL (per project) to fetch the openssf-scorecard json file.

In the lastest commit I have renamed the baseUrl to scorecardUrl.

Also, an important argument to keep the openssf/scorecardUrl in the component: the scorecardUrl is unique per component, therefore moving this to app-config.yaml doesn't make sense.

The argument about keeping url in the component due to being unique for the component can be resolved by using other annotations to specify parts of url, for example like github does with github.com/project-slug (but it would make code and setup more complex).
Not sure if exposing whole url is alright, but it is true there are some well known annotations that do that, like source location. The other thing that comes to mind is that if company moves to other domain where it publishes scorecard data, all component annotations will need to be updated.

In case auth is needed, we can in future utilize integrations no matter if we use the whole url in annotations or just part, so that is fine.

As shared in another comment, maybe align this with https://backstage.io/docs/features/software-catalog/well-known-annotations/ and call it [security-]scorecard-location ? Wdyt?

I think its a fair point to specific a base URL somewhere. But we can start simple and support first just "sources" and a base URL in the app-config later?

alizard0 · 2026-02-17T10:48:49Z

workspaces/scorecard/examples/openssf-scorecard-only.yaml

  name: openssf-scorecard
  annotations:
-    openssf/baseUrl: https://api.securityscorecards.dev/projects/github.com/alizard0/rhdh-plugins
+    openssf/scorecardUrl: https://api.securityscorecards.dev/projects/github.com/alizard0/rhdh-plugins


@dzemanov I think scorecardUrl is a better name for it.

Maybe you can align it with others annotations, see https://backstage.io/docs/features/software-catalog/well-known-annotations/ and call it openssf.dev/scorecard-location? Wdyt?

christoph-jerolimov · 2026-02-19T12:05:40Z

workspaces/scorecard/examples/openssf-scorecard-only.yaml

 kind: Component
 metadata:
-  name: openssf-scorecard-only
+  name: openssf-scorecard


Is the name change needed for something? The idea was that it is obvous that this entity has just openssf-scorecard scorecard features enabled.

christoph-jerolimov · 2026-02-19T12:06:37Z

workspaces/scorecard/plugins/scorecard-backend-module-openssf/README.md

- The repository is private (OpenSSF only analyzes public repositories)
- The repository path in the annotation is incorrect
- The metric score is lower than -1 or higher than 10.
+18 metrics from [OpenSSF checks](https://github.com/ossf/scorecard/blob/main/docs/checks.md): `openssf.binary_artifacts`, `openssf.branch_protection`, `openssf.cii_best_practices`, `openssf.ci_tests`, `openssf.code_review`, `openssf.contributors`, `openssf.dangerous_workflow`, `openssf.dependency_update_tool`, `openssf.fuzzing`, `openssf.license`, `openssf.maintained`, `openssf.packaging`, `openssf.pinned_dependencies`, `openssf.sast`, `openssf.security_policy`, `openssf.signed_releases`, `openssf.token_permissions`, `openssf.vulnerabilities`.


Why did you replaced the table with this metrics? I personally find a list or table more readable then this comma separated list?

christoph-jerolimov · 2026-02-19T12:08:25Z

workspaces/scorecard/plugins/scorecard-backend-module-openssf/README.md

-  type: service
-  lifecycle: production
-  owner: my-team
+    openssf/baseUrl: https://api.securityscorecards.dev/projects/github.com/owner/repo


I think you have changed this annotation

christoph-jerolimov · 2026-02-19T12:09:29Z

workspaces/scorecard/plugins/scorecard-backend-module-openssf/README.md

-For the OpenSSF metrics to work, your catalog entities must have the required annotation:
+| Annotation        | Required | Description                                                                 |
+| ----------------- | -------- | --------------------------------------------------------------------------- |
+| `openssf/baseUrl` | Yes      | Full scorecard API URL for this component (e.g. public API or self-hosted). |


You changed that annotation

christoph-jerolimov · 2026-02-19T12:13:39Z

workspaces/scorecard/plugins/scorecard-backend-module-openssf/src/clients/OpenSSFClient.ts

-    const apiUrl = `${this.baseUrl}/${this.gitServiceHost}/${owner}/${repo}`;
+  async getScorecard(entity: Entity): Promise<OpenSSFResponse> {
+    const scorecardUrl =
+      entity.metadata.annotations?.['openssf/scorecardUrl'] ?? '';


Can you please create a src/annotations.ts with an export for the annotations?

/** * @public */ export enum OpenSSFAnnotation { URL = 'openssf/scorecardUrl', }

And I've added above. Mayby this should be called "openssf.dev/scorecard-location"? /cc @dzemanov

why .dev?

rhdh-qodo-merge · 2026-02-19T15:30:43Z

CI Feedback 🧐

A test triggered by this PR failed. Here is an AI-generated analysis of the failure:

Action: check all required jobs
Failed stage: Run exit 1 [❌]
Failed test name: ""
Failure summary: The action failed because the workflow explicitly ran `exit 1`, which forces the step to terminate with a non-zero exit code. The failure occurs in the step `Run exit 1` (lines 41-45), causing the job to stop with `Process completed with exit code 1`.
Relevant error logs: 1: ##[group]Runner Image Provisioner 2: Hosted Compute Agent ... 30: Packages: write 31: Pages: write 32: PullRequests: write 33: RepositoryProjects: write 34: SecurityEvents: write 35: Statuses: write 36: ##[endgroup] 37: Secret source: Actions 38: Prepare workflow directory 39: Prepare all required actions 40: Complete job name: check all required jobs 41: ##[group]Run exit 1 42: �[36;1mexit 1�[0m 43: shell: /usr/bin/bash -e {0} 44: ##[endgroup] 45: ##[error]Process completed with exit code 1. 46: Cleaning up orphan processes

sonarqubecloud · 2026-02-19T15:31:31Z

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Remove abstract metric providers, left only openssf metric provider a…

3cbb66b

…nd simplied the usage of the openssf client by fetching scorecards only using a baseUrl

alizard0 requested review from a team, Eswaraiahsapram, christoph-jerolimov and its-mitesh-kumar as code owners February 10, 2026 10:26

alizard0 added the do-not-merge/work-in-progress label Feb 10, 2026

alizard0 added 3 commits February 10, 2026 13:11

fixed calculateMetric signature to receive entity as expected by the …

4c4db46

…interface, refactored tests

Merge branch 'main' into RHIDP-12106

b621e10

add component for testing the new baseUrl annotation for openssf scor…

8d0afbd

…ecard

Merge branch 'main' into RHIDP-12106

faa1564

alizard0 removed the do-not-merge/work-in-progress label Feb 11, 2026

Merge branch 'main' into RHIDP-12106

9741aa6

dzemanov requested changes Feb 12, 2026

View reviewed changes

alizard0 added 3 commits February 16, 2026 17:34

Merge branch 'main' into RHIDP-12106

e563c26

Merge branch 'main' into RHIDP-12106

58cfe83

rename baseUrl to scorecardUrl

33a1f8a

alizard0 commented Feb 17, 2026

View reviewed changes

alizard0 requested a review from dzemanov February 17, 2026 10:51

alizard0 added 5 commits February 17, 2026 15:40

Merge branch 'main' into RHIDP-12106

a0535e8

Merge branch 'main' into RHIDP-12106

7a175e1

run yarn prettier fix

0956b65

Merge branch 'main' into RHIDP-12106

333358e

Merge branch 'main' into RHIDP-12106

f629382

christoph-jerolimov reviewed Feb 19, 2026

View reviewed changes

alizard0 added 3 commits February 19, 2026 13:38

Merge branch 'main' into RHIDP-12106

0b78b07

review work

1927e76

Merge branch 'main' into RHIDP-12106

1b423d8

alizard0 requested a review from christoph-jerolimov February 19, 2026 15:26

rename variables to match scorecard-location changes

e841609

Comments

Conversation

alizard0 commented Feb 10, 2026

Hey, I just made a Pull Request!

✔️ Checklist

Uh oh!

rhdh-gh-app bot commented Feb 10, 2026

Missing Changesets

Changed Packages

Uh oh!

alizard0 commented Feb 11, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

christoph-jerolimov Feb 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rhdh-qodo-merge bot commented Feb 19, 2026

CI Feedback 🧐

Uh oh!

sonarqubecloud bot commented Feb 19, 2026

Quality Gate passed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

christoph-jerolimov Feb 19, 2026 •

edited

Loading