rhdh-scorecards

Use when setting up, configuring, and managing customizable Project Health Scorecards in Red Hat Developer Hub 1.10. Covers enabling the Scorecard plugin, configuring GitHub/Jira/OpenSSF/Filecheck metric providers, RBAC permissions, threshold customization, aggregated KPIs, homepage cards, and the Scorecard REST API. Do NOT use for general RHDH installation (use rhdh-install), Orchestrator workflows (use rhdh-orchestrator), or diagnostic data collection (use rhdh-diagnostic-data).

Jump to install

Repository: adnan-drina/rhoai3-coding-demo
Last source activity: July 6, 2026 at 19:14
Detected SKILL.md language: English
Stars: 3
Forks: 2

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

A direct command skips the review prompt. Inspect the source before running it.

npx skills add https://github.com/adnan-drina/rhoai3-coding-demo --skill rhdh-scorecards

The command stays on one line. Scroll horizontally to inspect it before copying.

Prefer a local copy? Download the files currently available to SkillsMP.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

File Explorer

3 files

SKILL.md

Source instructions · Read-only preview

Back to search Back to installation

paved-road-m1

Use at M1 ANALYZE as the kind index. Pin only --skill paved-road-m1. Follow steps.json in order (skill_view subskills; native kanban_attach.py). Happy-path terminator is kanban_request_review, not kanban_complete. kanban_block for external/platform (MaaS 500, missing key, GPU). Do not pin derive-legacy-boot3, scan-with-mta, and inventory-legacy-surface on the card. Do not use for M2 PLAN, M3, or M4.

2026-08-29

paved-road-m2

Use at M2 PLAN as the kind index. Pin only --skill paved-road-m2. Follow steps.json in order (skill_view speckit-specify then plan/tasks, plan-migration-partition producer, check-spec-readiness, native check-partition-coverage.py and assert-m2-speckit-conformance.py, k4_convert.py, k4_mint.py). Happy-path terminator is kanban_request_review, not kanban_complete. kanban_block for external/platform (MaaS 500, missing key, GPU). Do not pin plan-migration-partition and check-spec-readiness on the card. Do not use for M1, M3, or M4.

2026-08-29

check-spec-readiness

Before kanban_create — lint SDD specs, story bodies (typed BODY_* codes), and partition coverage (HTTP 1:1 via story.endpoints as METHOD /path, dest_file 1:N with supersede; refuse invented HTTP paths vs inventory; K4 dest_file round-trip REFUSE dest-9 Application.java/GreetingResource.java; refuse AC HTTP tokens that diverge from endpoints; refuse mvn test whose pom parent has no test-toolchain claim). Do not use to mint Kanban children or assemble M3 bodies (K4 converter is .hermes/kernel/k4_convert.py).

2026-08-28

View all from this repository

name	rhdh-scorecards
metadata	{"author":"rhoai3-coding-demo","version":"1.0.0","platform-family":"rhdh","platform-baseline":"repo","ocp-baseline":"repo","skill-group":"Developer Hub"}
description	Use when setting up, configuring, and managing customizable Project Health Scorecards in Red Hat Developer Hub 1.10. Covers enabling the Scorecard plugin, configuring GitHub/Jira/OpenSSF/Filecheck metric providers, RBAC permissions, threshold customization, aggregated KPIs, homepage cards, and the Scorecard REST API. Do NOT use for general RHDH installation (use rhdh-install), Orchestrator workflows (use rhdh-orchestrator), or diagnostic data collection (use rhdh-diagnostic-data).

RHDH Scorecards

Use this skill to configure and manage Project Health Scorecards in Red Hat Developer Hub 1.10 grounded in official product documentation.

Source Grounding

Read references/source-capture.md before using product behavior. Official Red Hat documentation is product authority.

Support Posture

The Scorecard plugin has mixed support levels:

GitHub and Jira metric providers — fully supported with configurable thresholds.
OpenSSF, Filecheck, and Dependabot providers — Developer Preview (not production-ready, no SLA).

Key Capabilities

Enable the Scorecard plugin — frontend and backend OCI packages in dynamic-plugin-config.yaml.
RBAC — permission scorecard.metric.read via CSV policy or Web UI; conditional policies using HAS_METRIC_ID rule.
GitHub metrics — github.open_prs via GitHub App or token; requires github.com/project-slug and backstage.io/source-location annotations.
Jira metrics — jira.open_issues via Cloud or Data Center; direct or proxy setup; requires jira/project-key annotation.
OpenSSF metrics — 16 fixed-threshold security scores (Developer Preview); requires openssf/scorecard-location annotation.
Filecheck metrics — boolean file-existence checks (Developer Preview); relies on backstage.io/source-location annotation.
Threshold customization — global in app-config.yaml, per-entity via scorecard.io/ annotations; sequential evaluation, most-restrictive first.
Custom severity levels — custom keys, colors (hex/rgb/theme palette), and icons (Material Design, Backstage system, SVG, URL).
Disable metrics — per-entity via scorecard.io/disabled-metrics annotation; globally via scorecard.disabledMetrics.
Aggregated KPIs — statusGrouped or average types under scorecard.aggregationKPIs; homepage cards via ScorecardHomepageCard.
Metric scheduling — per-metric cron via scorecard.plugins.<source>.<metric>.schedule.
Data retention — scorecard.dataRetentionDays (default: 365).
Scorecard REST API — GET /metrics, GET /metrics/catalog/:kind/:namespace/:name, GET /aggregations/:aggregationId.

Plugin Packages

Component	OCI Package
Frontend	`red-hat-developer-hub-backstage-plugin-scorecard`
Backend	`red-hat-developer-hub-backstage-plugin-scorecard-backend`
GitHub module	`red-hat-developer-hub-backstage-plugin-scorecard-backend-module-github`
Jira module	`red-hat-developer-hub-backstage-plugin-scorecard-backend-module-jira`
OpenSSF module	`red-hat-developer-hub-backstage-plugin-scorecard-backend-module-openssf`
Filecheck module	`red-hat-developer-hub-backstage-plugin-scorecard-backend-module-filecheck`

All packages use format bs_<backstage_version>__<plugin_version> tags from ghcr.io/redhat-developer/rhdh-plugin-export-overlays/.

Catalog Entity Annotations

Annotation	Provider	Required
`github.com/project-slug`	GitHub	Yes
`backstage.io/source-location`	GitHub, Filecheck	Yes
`jira/project-key`	Jira	Yes
`jira/component`, `jira/label`, `jira/team`, `jira/custom-filter`	Jira	No
`openssf/scorecard-location`	OpenSSF	Yes
`scorecard.io/disabled-metrics`	All	No
`scorecard.io/<metricId>.thresholds.rules.<key>`	Configurable	No

Workflow

Read references/official-doc-extraction.md for exact YAML patterns.
Identify the task: enable plugin, configure a provider, set RBAC, customize thresholds, configure aggregated KPIs, or add homepage cards.
Use exact OCI package references with bs_<version>__<version> tags.
Validate with the verification steps documented per section.
Never invent plugin config fields not documented in the official source.

Related Skills

rhdh-diagnostic-data — must-gather diagnostic data collection
rhdh-orchestrator — Orchestrator serverless workflows

References

references/source-capture.md
references/official-doc-extraction.md

rhdh-scorecards

Source facts

Install options

Review the source files

More from this repository

More from this repository

RHDH Scorecards

Source Grounding

Support Posture

Key Capabilities

Plugin Packages

Catalog Entity Annotations

Workflow

Related Skills

References

RHDH Scorecards

Source Grounding

Support Posture

Key Capabilities

Plugin Packages

Catalog Entity Annotations

Workflow

Related Skills

References