feat: implement scorecard-classic command #2433

AlbinaBlazhko17 · 2025-12-01T16:55:44Z

What/Why/How?

Added new command scorecard-classic.
Implemented functionality to fetch scorecard and plugins from project url.
Implemented functionality to pass project url in arguments.
Implemented functionality to use API key to fetch data.
Implemented functionality to be able to output the result in JSON and stylish formats.
Implemented functionality to check if command run in CI and throw error if API key is missing.
Implemented functionality to check api level.
Added verbose logs.
Added tests.

Reference

Related: https://github.com/Redocly/redocly/issues/8775

Testing

Ran tests.

Screenshots (optional)

Check yourself

Code changed? - Tested with Redoc/Realm/Reunite (internal)
All new/updated code is covered by tests
New package installed? - Tested in different environments (browser/node)
Documentation update considered

Security

The security impact of the change has been considered
Code follows company security practices and guidelines

changeset-bot · 2025-12-01T16:55:48Z

🦋 Changeset detected

Latest commit: c182102

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
@redocly/cli	Patch
@redocly/openapi-core	Patch
@redocly/respect-core	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

github-actions · 2025-12-01T16:57:20Z

Command	Mean [s]	Min [s]	Max [s]	Relative
`redocly lint resources/rebilly.yaml`	1.437 ± 0.058	1.379	1.588	1.00 ± 0.05
`redocly-next lint resources/rebilly.yaml`	1.435 ± 0.030	1.395	1.485	1.00

github-actions · 2025-12-01T16:57:55Z

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	78.59% (🎯 78%)	6104 / 7766
🔵	Statements	78.08% (🎯 78%)	6308 / 8078
🔵	Functions	82.11% (🎯 81%)	1249 / 1521
🔵	Branches	70.57% (🎯 70%)	4200 / 5951

File Coverage

File	Stmts	Branches	Functions	Lines	Uncovered Lines
Changed Files
packages/cli/src/commands/scorecard-classic/index.ts	0%	0%	0%	0%	21-129
packages/cli/src/commands/scorecard-classic/auth/login-handler.ts	100%	88.88%	100%	100%
packages/cli/src/commands/scorecard-classic/formatters/json-formatter.ts	96.77%	86.66%	100%	96.55%	36
packages/cli/src/commands/scorecard-classic/formatters/stylish-formatter.ts	100%	88.46%	100%	100%
packages/cli/src/commands/scorecard-classic/remote/fetch-scorecard.ts	80.3%	75.92%	100%	80.3%	58-61, 71-74, 128-129, 161, 168-171
packages/cli/src/commands/scorecard-classic/validation/plugin-evaluator.ts	83.33%	73.68%	100%	82.75%	17, 59-62
packages/cli/src/commands/scorecard-classic/validation/validate-scorecard.ts	97.22%	88.88%	100%	97.05%	38-40

Generated in workflow #8164 for commit c182102 by the Vitest Coverage Report Action

packages/cli/src/index.ts

packages/cli/src/commands/scorecard-classic/validation/plugin-evaluator.ts

DmitryAnansky · 2025-12-10T09:33:36Z

packages/cli/src/commands/scorecard-classic/validation/validate-scorecard.ts

+        ? await evaluatePluginsFromCode(pluginsCodeOrPlugins)
+        : pluginsCodeOrPlugins;
+
+    const config = await createConfig({ ...level, plugins } as RawUniversalConfig, {


Just an open question.
So are we going to ignore local config in case when scorecards defined?

Yeah, i think, @tatomyr can suggest.

yes, if scorecard is defined -- use it instead of the local config (for scorecards).

packages/cli/src/commands/scorecard-classic/remote/fetch-scorecard.ts

packages/cli/src/commands/scorecard-classic/index.ts

packages/cli/src/index.ts

packages/cli/src/commands/scorecard-classic/formatters/json-formatter.ts

packages/cli/src/commands/scorecard-classic/auth/login-handler.ts

packages/cli/src/commands/scorecard-classic/index.ts

packages/cli/src/commands/scorecard-classic/auth/login-handler.ts

tatomyr · 2025-12-10T10:08:15Z

packages/cli/src/commands/scorecard-classic/auth/login-handler.ts

+export async function handleLoginAndFetchToken(config: Config): Promise<string | undefined> {
+  const reuniteUrl = getReuniteUrl(config, config.resolvedConfig?.residency);
+
+  const oauthClient = new RedoclyOAuthClient();


Cannot we just re-use the login handler if the user is not authenticated?

No, we cannot, because login handler doesn't check if we already store the credentials and they are exist.

packages/cli/src/commands/scorecard-classic/remote/fetch-scorecard.ts

docs/@v2/commands/scorecard-classic.md

packages/cli/src/commands/scorecard-classic/validation/validate-scorecard.ts

docs/@v2/commands/scorecard-classic.md

packages/cli/src/commands/scorecard-classic/__tests__/fetch-scorecard.test.ts

packages/cli/src/commands/scorecard-classic/index.ts

packages/cli/src/commands/scorecard-classic/validation/validate-scorecard.ts

packages/cli/src/commands/scorecard-classic/index.ts

AlbinaBlazhko17 self-assigned this Dec 1, 2025

AlbinaBlazhko17 changed the title ~~Feat/add scorecard~~ feat: implement scorecard-classic command Dec 3, 2025

AlbinaBlazhko17 force-pushed the feat/add-scorecard branch 2 times, most recently from 031a5a1 to 80fc819 Compare December 9, 2025 13:59

tatomyr reviewed Dec 9, 2025

View reviewed changes

packages/cli/src/index.ts Outdated Show resolved Hide resolved