jentic/Jentic API Scorecard

Score an OpenAPI doc against the Jentic API AI Readiness Framework; gate CI and publish SARIF + an HTML scorecard.

View on GitHub

Trust Signals

Scorecard Score
not yet scored
Maintenance Recency
Activelast commit Jul 10, 2026
License
Apache 2.0

Pinned Snippet

workflow.ymlSHA-pinned
uses: jentic/jentic-api-scorecard@25ea914b2f085f7ed2d92083a7fa40daa3fb417c # v1.9.3

tags can be moved; commit SHAs can't. why a SHA?

namedescriptionrequireddefault
inputhttps:// URL or local file path to an OpenAPI document to score.yes
api-keyJentic API key, forwarded to the CLI as JENTIC_API_KEY. Required for local files and URLs outside the jentic-public-apis allowlist; omit for anonymous allowlisted URLs.no""
github-tokenToken used to upload SARIF to the Security tab. Defaults to the workflow GITHUB_TOKEN, which is enough for same-repo runs with security-events: write. Advanced: supply a GitHub App / PAT, or a writable token from a base-context workflow_run/pull_request_target workflow, to upload findings that a plain fork pull_request cannot (its token is read-only by design).no${{ github.token }}
min-scoreFail the build when summary.score is strictly below this value. Unset = no score gate.no""
max-errorsFail when error-level findings exceed this count. Unset = no error gate.no""
max-warningsFail when warning-level findings exceed this count. Unset = no warning gate.no""
severityMinimum level to include in the uploaded SARIF: error | warning | note.nowarning
max-findingsCap the SARIF results, dropping lowest-severity-first. GitHub allows at most 5000.no5000
with-llmEnable LLM-backed analysis (requires LLM provider env vars on the runner).nofalse
summary-detailDetail depth of the Markdown run summary only: summary | dimensions | signals | diagnostics.nodimensions
artifact-nameName of the uploaded HTML scorecard artifact. Override when invoking the action more than once in a workflow run (upload-artifact requires unique names).noscorecard-html
cli-versionThe @jentic/api-scorecard-cli version to run (npm tag or exact version). Leave unset to use the version that ships with the action ref you pinned — read from the action's own packages/cli/package.json — which keeps the CLI, its engine image, and the action in lockstep (CLI version = image tag invariant). Set an explicit version only to override that.no""

no outputs