Procedure

1. Set the required RBAC permissions using any of the following methods:

   • To use the csv file, in your csv file, you can directly add the following code:

     g, user:default/<YOUR_USERNAME>, role:default/scorecard-viewer
     p, role:default/scorecard-viewer, scorecard.metric.read, read, allow
     p, role:default/scorecard-viewer, catalog.entity.read, read, allow

     See Permission policies reference.

   • To use the RBAC Web UI, complete the following steps:

     1. In your Red Hat Developer Hub menu, go to Administration > RBAC.
     2. Select or create the Role to which you want to grant access to the Scorecards.
     3. To enable read access for the Scorecard plugin, in Add permission policies, select Scorecard from the plugins dropdown.

     4. Expand Scorecard, select policy with the following details, and click Next:

        • Name: scorecard.metric.read
        • Permission: read

Procedure

1. Create and configure a GitHub App.

   1. Create the GitHub App with Read-only permissions for Contents to allow reading repositories.
   2. Generate a client secret and a private key.
   3. Install the app on the desired account or organization.

   4. Save the following credential values:

      • App ID
      • Client ID
      • Client secret
      • Private key

2. Add GitHub credentials to your RHDH secrets.

   Set the following key/value pairs as environment variables in your secrets store:

   • GITHUB_INTEGRATION_APP_ID
   • GITHUB_INTEGRATION_CLIENT_ID
   • GITHUB_INTEGRATION_CLIENT_SECRET
   • GITHUB_INTEGRATION_HOST_DOMAIN (e.g., github.com)
   • GITHUB_INTEGRATION_PRIVATE_KEY_FILE

3. Configure the GitHub integration in your RHDH app-config.yaml.

   Add the integrations.github section to your custom RHDH app-config.yaml configuration file using the environment variables:

   integrations:
     github:
       - host: ${GITHUB_INTEGRATION_HOST_DOMAIN}
         apps:
           - appId: ${GITHUB_INTEGRATION_APP_ID}
             clientId: ${GITHUB_INTEGRATION_CLIENT_ID}
             clientSecret: ${GITHUB_INTEGRATION_CLIENT_SECRET}
             privateKey: |
               ${GITHUB_INTEGRATION_PRIVATE_KEY_FILE}

4. Annotate the component entity in catalog-info.yaml.

   Link a software component to the GitHub data source by adding the required annotations to its catalog-info.yaml file as shown in the following example:

   apiVersion: backstage.io/v1alpha1
   kind: Component
   metadata:
     name: my-service
     annotations:
       # Required: GitHub project slug in format "owner/repository"
       github.com/project-slug: myorg/my-service
       # Required: Entity source location
       backstage.io/source-location: url:https://github.com/myorg/my-service
   spec:
     type: service
     lifecycle: production
     owner: _<your_team_name>_

   Where:

   annotations:github.com/project-slug

   The GitHub repository format, for example, owner/repository.

   annotations:backstage.io/source-location

   The entity source location format, for example, url:https://github.com/owner/repository.

   spec:owner

   Your team name.

1. (Optional) Configure metric threshold values.

   To customize the thresholds for the GitHub Open Pull Requests (github.open_prs) metric, add the following section to your app-config.yaml file:

   scorecard:
     plugins:
       github:
         open_prs:
           thresholds:
             rules:
               - key: success
                 expression: '<10'
               - key: warning
                 expression: '10-50'
               - key: error
                 expression: '>50'

   scorecard:plugins:github:open_prs:thresholds

   Lists the default threshold values for the GitHub open PRs metric.

Procedure

1. Create a Jira configuration token using one of the following methods, depending on your Jira product:

   • Jira Cloud: Create a personal token. You must then create a Base64-encoded string using the following plain text format: your-atlassian-email:your-jira-api-token.

     echo -n 'your-atlassian-email:your-jira-api-token' | base64

   • Jira datacenter: Create and use a Personal Access Token (PAT) in your Jira datacenter account. For more information, see the Atlassian documentation.

2. Configure the Jira Scorecard plugin in your RHDH dynamic-plugins-config.yaml using either a direct setup or a proxy setup.

   1. Use a direct setup: Add the following code to your RHDH dynamic-plugins-config.yaml:

      plugins:
        - package: oci://ghcr.io/redhat-developer/rhdh-plugin-export-overlays/red-hat-developer-hub-backstage-plugin-scorecard-backend-module-jira:pr_1499__0.1.0!red-hat-developer-hub-backstage-plugin-scorecard-backend-module-jira
          disabled: false
          pluginConfig:
            jira:
              baseUrl: ${JIRA_BASE_URL}
              token: ${JIRA_TOKEN}
              product: datacenter # Change to 'cloud' if using Jira Cloud

      where:

      baseUrl

      Enter the Jira URL.

      token

      Enter the Jira token (Base64 string for Cloud, PAT for Data Center).

      product

      Enter the supported product: cloud or datacenter.

   2. Use a proxy setup: In your RHDH dynamic-plugins-config.yaml, add the following code:

      plugins:
        - package: oci://ghcr.io/redhat-developer/rhdh-plugin-export-overlays/red-hat-developer-hub-backstage-plugin-scorecard-backend-module-jira:pr_1499__0.1.0!red-hat-developer-hub-backstage-plugin-scorecard-backend-module-jira
          disabled: false
          pluginConfig:
            jira:
              proxyPath: /jira/api
              product: datacenter # Change to 'cloud' if using Jira Cloud

      1. In your RHDH app-config.yaml file, add the following proxy settings:

         proxy:
           endpoints:
             '/jira/api':
               target: ${JIRA_BASE_URL}
               headers:
                 Accept: 'application/json'
                 Content-Type: 'application/json'
                 X-Atlassian-Token: 'no-check'
                 Authorization: ${JIRA_TOKEN} # Must be configured in your environment

         where:

         Authorization

         Set any of the following header value:

         • For Cloud: Basic YourCreatedAboveToken
         • For Data Center: Bearer YourJiraToken

3. Annotate the component entity in the catalog-info.yaml.

   1. In the catalog-info.yaml file for the entity you want to configure, link the component to the Jira data source by adding the necessary annotations:

      apiVersion: backstage.io/v1alpha1
      kind: Component
      metadata:
        name: my-service
        annotations:
          jira/project-key: PROJECT
          jira/component: Component
          jira/label: UI
          jira/team: 9d3ea319-fb5b-4621-9dab-05fe502283e
          jira/custom-filter: 'reporter = "abc@xyz.com" AND resolution is not EMPTY'
      spec:
        type: website
        lifecycle: experimental
        owner: guests
        system: examples
        providesApis: [example-grpc-api]

      where:

      jira/project-key

      Required: Enter the Jira project key.

      jira/component

      Optional: Enter the Jira component name.

      jira/label

      Optional: Enter the Jira label.

      jira/team

      Optional: Enter the Jira team ID (not the team title).

      jira/custom-filter

      Optional: Enter a custom Jira Query Language (JQL) filter.

4. (Optional) Configure Jira Open Issues metric thresholds.

   1. To customize the thresholds for the Jira Open Issues (jira.open_issues) metric, add the following to your RHDH app-config.yaml file:

      scorecard:
        plugins:
          jira:
            open_issues:
              thresholds:
                rules:
                  - key: success
                    expression: '<10'
                  - key: warning
                    expression: '10-50'
                  - key: error
                    expression: '>50'

      where

      scorecard:plugins:jira:open_issues:thresholds

      Lists the default threshold values for the Jira open Issues metric.

5. (Optional) Define global or custom mandatory filters.

   1. You can apply global mandatory filters or define custom filters that entities can override. Add the following to your RHDH app-config.yaml:

      scorecard:
        plugins:
          jira:
            open_issues:
              options:
                mandatoryFilter: Type = Task AND Resolution = Resolved
                customFilter: priority in ("Critical", "Blocker")

      where:

      mandatoryFilter

      Optional: Replaces the default filter (type = Bug and resolution = Unresolved).

      customFilter

      Optional: Specifies a global custom filter. The entity annotation jira/custom-filter overrides this value.