jentic/Jentic API Scorecard
Score an OpenAPI doc against the Jentic API AI Readiness Framework; gate CI and publish SARIF + an HTML scorecard.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 10, 2026
- License
- Apache 2.0
Pinned Snippet
uses: jentic/jentic-api-scorecard@25ea914b2f085f7ed2d92083a7fa40daa3fb417c # v1.9.3tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| input | https:// URL or local file path to an OpenAPI document to score. | yes | — |
| api-key | Jentic API key, forwarded to the CLI as JENTIC_API_KEY. Required for local files and URLs outside the jentic-public-apis allowlist; omit for anonymous allowlisted URLs. | no | "" |
| github-token | Token used to upload SARIF to the Security tab. Defaults to the workflow GITHUB_TOKEN, which is enough for same-repo runs with security-events: write. Advanced: supply a GitHub App / PAT, or a writable token from a base-context workflow_run/pull_request_target workflow, to upload findings that a plain fork pull_request cannot (its token is read-only by design). | no | ${{ github.token }} |
| min-score | Fail the build when summary.score is strictly below this value. Unset = no score gate. | no | "" |
| max-errors | Fail when error-level findings exceed this count. Unset = no error gate. | no | "" |
| max-warnings | Fail when warning-level findings exceed this count. Unset = no warning gate. | no | "" |
| severity | Minimum level to include in the uploaded SARIF: error | warning | note. | no | warning |
| max-findings | Cap the SARIF results, dropping lowest-severity-first. GitHub allows at most 5000. | no | 5000 |
| with-llm | Enable LLM-backed analysis (requires LLM provider env vars on the runner). | no | false |
| summary-detail | Detail depth of the Markdown run summary only: summary | dimensions | signals | diagnostics. | no | dimensions |
| artifact-name | Name of the uploaded HTML scorecard artifact. Override when invoking the action more than once in a workflow run (upload-artifact requires unique names). | no | scorecard-html |
| cli-version | The @jentic/api-scorecard-cli version to run (npm tag or exact version). Leave unset to use the version that ships with the action ref you pinned — read from the action's own packages/cli/package.json — which keeps the CLI, its engine image, and the action in lockstep (CLI version = image tag invariant). Set an explicit version only to override that. | no | "" |
Outputs
no outputs