feat(scorecard): File level checks - all providers by djanickova · Pull Request #2913 · redhat-developer/rhdh-plugins

djanickova · 2026-04-24T11:22:13Z

Hey, I just made a Pull Request!

This is the second version of the new filecheck scorecard. The implementation is now provider agnostic and works for all SCMs. It contains mostly the same functionality as #2751, but the logic was moved from the github module into a new filecheck module.

This PR introduces a new type of scorecard: file level checks (RHDHPLAN-397). This adds ability for Scorecard to verify if a list of required files (one or more) is present (such as a license, CODEOWNERS, dockerfile, .gitignore, etc). The paths to these files are configurable.

Example of these scorecards on the entity page:

✔️ Checklist

A changeset describing the change and affected packages. (more info)
Added or Updated documentation
Tests for new functionality and regression tests for bug fixes
Screenshots attached (for UI changes)

Signed-off-by: Diana Janickova <djanicko@redhat.com> test: implement and update unit tests Assisted-By: Cursor Signed-off-by: Diana Janickova <djanicko@redhat.com> chore: generate api reports Signed-off-by: Diana Janickova <djanicko@redhat.com> ref: use metricId instead of providerId Signed-off-by: Diana Janickova <djanicko@redhat.com> ref: Apply suggestions from code review Co-authored-by: Ihor Mykhno <imykhno@redhat.com> fix: run prettier Signed-off-by: Diana Janickova <djanicko@redhat.com> fix: update expected string in test Signed-off-by: Diana Janickova <djanicko@redhat.com>

Signed-off-by: Diana Janickova <djanicko@redhat.com> feat: implement aggregated card and update test Signed-off-by: Diana Janickova <djanicko@redhat.com> feat: include aggregated card in App.tsx Signed-off-by: Diana Janickova <djanicko@redhat.com> fix: pass logger as param Signed-off-by: Diana Janickova <djanicko@redhat.com> ref: remove default boolean tresholds, edit translation Signed-off-by: Diana Janickova <djanicko@redhat.com> chore: generate api reports Signed-off-by: Diana Janickova <djanicko@redhat.com> test: e2e test scenario for file checks Signed-off-by: Diana Janickova <djanicko@redhat.com> fix: selectors in test Signed-off-by: Diana Janickova <djanicko@redhat.com> feat: include file check section in app-config.yaml Signed-off-by: Diana Janickova <djanicko@redhat.com> fix: aggregated permission card title and desc Signed-off-by: Diana Janickova <djanicko@redhat.com> ref: move tresholds from scorecard-common Signed-off-by: Diana Janickova <djanicko@redhat.com> fix: off center icon and treshold imports Signed-off-by: Diana Janickova <djanicko@redhat.com> feat: add new translations Signed-off-by: Diana Janickova <djanicko@redhat.com> ref: implement resolveMetricTranslation Signed-off-by: Diana Janickova <djanicko@redhat.com> fix: resolve translations correctly Signed-off-by: Diana Janickova <djanicko@redhat.com> ref: use useMemo in EmptyStatePanel Signed-off-by: Diana Janickova <djanicko@redhat.com> fix: use translations in test Signed-off-by: Diana Janickova <djanicko@redhat.com>

Signed-off-by: Diana Janickova <djanicko@redhat.com>

rhdh-gh-app · 2026-04-24T11:22:35Z

Important

This PR includes changes that affect public-facing API. Please ensure you are adding/updating documentation for new features or behavior.

Changed Packages

Package Name	Package Path	Changeset Bump	Current Version
app-legacy	workspaces/scorecard/packages/app-legacy	none	`v0.0.0`
backend	workspaces/scorecard/packages/backend	none	`v0.0.0`
@red-hat-developer-hub/backstage-plugin-scorecard-backend-module-filecheck	workspaces/scorecard/plugins/scorecard-backend-module-filecheck	minor	`v0.0.0`
@red-hat-developer-hub/backstage-plugin-scorecard-backend	workspaces/scorecard/plugins/scorecard-backend	minor	`v2.5.2`
@red-hat-developer-hub/backstage-plugin-scorecard-node	workspaces/scorecard/plugins/scorecard-node	minor	`v2.5.2`
@red-hat-developer-hub/backstage-plugin-scorecard	workspaces/scorecard/plugins/scorecard	minor	`v2.5.2`

Signed-off-by: Diana Janickova <djanicko@redhat.com>

djanickova · 2026-04-24T14:24:27Z

Tested this by having both Github and Gitlab components in my catalog, scorecards showed up correctly for both of these.

Example for a Gitlab component (I added one more filecheck locally to app-config compared to what is there by default):

Example of an aggregated card (with custom title) detail when I have 2 entities:

Most of the code (especially for scorecard and scorecard-backend packages) remains unchanged compared to #2751.

Signed-off-by: Diana Janickova <djanicko@redhat.com>

christoph-jerolimov

Hi @djanickova, great work 👍

I didn't tested this PR myself but wanted drop some thoughts for you, and @dzemanov, @imykhno, @PatAKnight because I'm off next week. You can pick or ignore based on your internal or scorecard meeting discussions on Monday:

christoph-jerolimov · 2026-04-24T14:50:37Z

+      const tree = await this.urlReader.readTree(target, {
+        etag: cached?.etag,
+        filter: filePath => pathsSet.has(filePath),
+      });
+
+      const files = await tree.files();
+      foundPaths = new Set(files.map(f => f.path));
+      this.cache.set(cacheKey, { etag: tree.etag, foundPaths });


I don't say its wrong, but someone should test this with a big repo. It's probably better to make 3 readUrl calls here instead of one big readTree. In the GH implementation it looks like it downloads the complete repo for that. Also if its just downloaded to a tmp folder, it's probably saver (security concerns with cloned git repos into RHDH) to just download the README, LICENSE, and what else file instead of the complete repo.

We have discussed this and came to the conclusion to leave it as it is for now. Both readTree and readUrl have disadvantages and with readTree, there is a smaller chance of hitting rate limits. We can also use etags and caching to further optimize readTree. We can always come back to this if we find out that the current approach is not good :)

christoph-jerolimov · 2026-04-24T14:54:21Z

+    const keys = fileConfig.keys();
+    if (keys.length !== 1) {
+      throw new Error(
+        'Each file config entry must have exactly one key-value pair',
+      );
+    }
+    const id = keys[0];


Just as an idea: Why not using then an object?

filecheck: files: license: 'LICENSE' codeowners: 'CODEOWNERS'

Thank you for the suggestion, I think an object would be better and cleaner. I refactored the code to use objects instead

christoph-jerolimov · 2026-04-24T14:57:43Z

+    filecheck:
+      files:
+        - readme: README.md
+        - license: LICENSE


LICENSE, LICENSE.txt, ...

It's fine, but really expect that this will come back that each metric should support multiple filenames.

The time might not be enough anymore, but I would recommend:

scorecard: plugins: filecheck: readme: files: README.md license: files: - LICENSE - LICENSE.txt

That would also allow you later to add other configurations for a metric. Like caseInsensitivity: true or whatever...

I agree that it will be handy to have the option to define multiple paths per file. However, I would keep the changes now at minimum considering we do not have much time left

PatAKnight

Thank you for this @djanickova!! Some suggestions

Signed-off-by: Diana Janickova <djanicko@redhat.com>

sonarqubecloud · 2026-04-27T09:27:04Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Eswaraiahsapram

Thanks, @djanickova. Reviewed the frontend changes and tested locally. Looks good to me 🎉

Screen.Recording.2026-04-27.at.3.47.53.PM.mov

PatAKnight

LGTM

djanickova added 30 commits April 13, 2026 10:59

Merge branch 'main' into scorecard-file-level-checks

f0385fd

ref: use resolveMetricTranslation helper

155643b

Signed-off-by: Diana Janickova <djanicko@redhat.com>

chore: re-add changes not solved in conflicts

4c87647

Signed-off-by: Diana Janickova <djanicko@redhat.com>

chore: fix yarn tsc

154747e

Signed-off-by: Diana Janickova <djanicko@redhat.com>

fix: do not show icon for boolean metric type

3956b85

Signed-off-by: Diana Janickova <djanicko@redhat.com>

fix: pass extra props to db in pullProviderMetrics

b6b3404

Signed-off-by: Diana Janickova <djanicko@redhat.com>

fix: aggregations endpoint for batch providers

269ca6d

Signed-off-by: Diana Janickova <djanicko@redhat.com>

chore: fix prettier

31c2393

Signed-off-by: Diana Janickova <djanicko@redhat.com>

ref: fix sonarqube issues

5e21972

Signed-off-by: Diana Janickova <djanicko@redhat.com>

fix: broken test

768ad4d

Signed-off-by: Diana Janickova <djanicko@redhat.com>

feat: show aggregated cards for file checks

ae8c0a8

Signed-off-by: Diana Janickova <djanicko@redhat.com>

ref: fix sonarqube issue

554dd8a

Signed-off-by: Diana Janickova <djanicko@redhat.com>

chore: generate changeset, update readme

4c04759

Signed-off-by: Diana Janickova <djanicko@redhat.com>

ref: use license and codeowners as examples

87d44b2

Signed-off-by: Diana Janickova <djanicko@redhat.com>

fix: implement qodo suggestions

3383dfa

Signed-off-by: Diana Janickova <djanicko@redhat.com>

fix: return empty map for no files

56289e1

Signed-off-by: Diana Janickova <djanicko@redhat.com>

ref: fix sonarqube issues

4bbe474

Signed-off-by: Diana Janickova <djanicko@redhat.com>

feat: add aggregation card with custom title

9b4f0d1

Signed-off-by: Diana Janickova <djanicko@redhat.com>

Merge branch 'main' into scorecard-file-level-checks

671e690

Merge branch 'main' into scorecard-file-level-checks

d680d66

fix: use ScorecardHomepageCardWithProvider

7df0227

Signed-off-by: Diana Janickova <djanicko@redhat.com>

wip: migrate functionality to new module

1dad625

Signed-off-by: Diana Janickova <djanicko@redhat.com>

wip: rename files_check to filecheck

e32203c

Signed-off-by: Diana Janickova <djanicko@redhat.com>

fix: translation cascading lookup, remove Github keyword

fb11af5

Signed-off-by: Diana Janickova <djanicko@redhat.com>

ref: restructure based on other modules

7a85748

Signed-off-by: Diana Janickova <djanicko@redhat.com>

ref: use readTree instead of readUrl

2fd3e75

Signed-off-by: Diana Janickova <djanicko@redhat.com>

fix: app config and tests

daffa57

Signed-off-by: Diana Janickova <djanicko@redhat.com>

chore: regenerate api reports

aa463fe

Signed-off-by: Diana Janickova <djanicko@redhat.com>

openshift-ci Bot added the do-not-merge/work-in-progress label Apr 24, 2026

github-actions Bot added the workspace/scorecard label Apr 24, 2026

djanickova added 6 commits April 24, 2026 13:35

fix: sonarqube issues, package.json

d4b709c

Signed-off-by: Diana Janickova <djanicko@redhat.com>

fix: CI failures

0c6612a

Signed-off-by: Diana Janickova <djanicko@redhat.com>

fix: add Jira open issues to App.tsx

3e1a608

Signed-off-by: Diana Janickova <djanicko@redhat.com>

doc: update READMEs

b094d5f

Signed-off-by: Diana Janickova <djanicko@redhat.com>

fix: add filecheck module to index.ts

7a663f6

Signed-off-by: Diana Janickova <djanicko@redhat.com>

chore: generate changeset

f4a71cd

Signed-off-by: Diana Janickova <djanicko@redhat.com>

djanickova marked this pull request as ready for review April 24, 2026 13:58

djanickova requested review from a team, Eswaraiahsapram, christoph-jerolimov and its-mitesh-kumar as code owners April 24, 2026 13:58

openshift-ci Bot removed the do-not-merge/work-in-progress label Apr 24, 2026

fix: use correct aggregationId in legacy app

e7a855b

Signed-off-by: Diana Janickova <djanicko@redhat.com>

christoph-jerolimov reviewed Apr 24, 2026

View reviewed changes

PatAKnight reviewed Apr 25, 2026

View reviewed changes

ref: implement feedback from reviews

48492c0

Signed-off-by: Diana Janickova <djanicko@redhat.com>

Eswaraiahsapram approved these changes Apr 27, 2026

View reviewed changes

PatAKnight approved these changes Apr 27, 2026

View reviewed changes

djanickova merged commit 4ecaacd into redhat-developer:main Apr 27, 2026
13 checks passed

Conversation

djanickova commented Apr 24, 2026

Hey, I just made a Pull Request!

✔️ Checklist

Uh oh!

rhdh-gh-app Bot commented Apr 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changed Packages

Uh oh!

djanickova commented Apr 24, 2026

Uh oh!

christoph-jerolimov left a comment

Choose a reason for hiding this comment

Uh oh!

christoph-jerolimov Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

djanickova Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

christoph-jerolimov Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

djanickova Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

christoph-jerolimov Apr 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

djanickova Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

PatAKnight left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sonarqubecloud Bot commented Apr 27, 2026

Quality Gate passed

Uh oh!

Eswaraiahsapram left a comment

Choose a reason for hiding this comment

Uh oh!

PatAKnight left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

rhdh-gh-app Bot commented Apr 24, 2026 •

edited

Loading

christoph-jerolimov Apr 24, 2026 •

edited

Loading