• Implement batch metric providers supporting multiple metrics per provider
• Add GitHub file existence checks (readme, license, codeowners, etc.)
• Refactor MetricProvidersRegistry to handle batch and single providers
• Add translation support for parameterized metric titles/descriptions
• Update UI components to display boolean metrics correctly

Add optional batch provider methods to interface

workspaces/scorecard/plugins/scorecard-node/src/api/MetricProvider.ts

Support batch providers with multiple metric IDs

workspaces/scorecard/plugins/scorecard-backend/src/providers/MetricProvidersRegistry.ts

Implement batch provider for file existence checks

workspaces/scorecard/plugins/scorecard-backend-module-github/src/metricProviders/GithubFilesProvider.ts

Description

The PR adds installable example homepage cards/widgets for github.files_check.readme and
github.files_check.i18guide, but does not provide an installable example card for both LICENSE
and CODEOWNERS checks. This fails the requirement to ship a reference example covering LICENSE
and CODEOWNERS.

Code

workspaces/scorecard/packages/app-legacy/src/App.tsx[R220-279]

+  {
+    Component: ScorecardHomepageCard as ComponentType,
+    config: {
+      id: 'scorecard-github.files_check.readme',
+      title: 'Scorecard: README file exists',
+      cardLayout: {
+        width: {
+          minColumns: 3,
+          maxColumns: 12,
+          defaultColumns: 4,
+        },
+        height: {
+          minRows: 5,
+          maxRows: 12,
+          defaultRows: 6,
+        },
+      },
+      layouts: {
+        xl: { w: 4, h: 6 },
+        lg: { w: 4, h: 6 },
+        md: { w: 4, h: 6 },
+        sm: { w: 4, h: 6 },
+        xs: { w: 4, h: 6 },
+        xxs: { w: 4, h: 6 },
+      },
+      props: {
+        aggregationId: 'github.files_check.readme',
+      },
+    },
+  },
+  {
+    Component: ScorecardHomepageCard as ComponentType,
+    config: {
+      id: 'scorecard-github.files_check.i18guide',
+      title: 'Scorecard: i18n guide file exists',
+      cardLayout: {
+        width: {
+          minColumns: 3,
+          maxColumns: 12,
+          defaultColumns: 4,
+        },
+        height: {
+          minRows: 5,
+          maxRows: 12,
+          defaultRows: 6,
+        },
+      },
+      layouts: {
+        xl: { w: 4, h: 6, x: 4 },
+        lg: { w: 4, h: 6, x: 4 },
+        md: { w: 4, h: 6, x: 4 },
+        sm: { w: 4, h: 6, x: 4 },
+        xs: { w: 4, h: 6, x: 4 },
+        xxs: { w: 4, h: 6, x: 4 },
+      },
+      props: {
+        aggregationId: 'github.files_check.i18guide',
+      },
+    },
+  },

Evidence

Compliance ID 6 requires an installable example Scorecard card for both LICENSE and CODEOWNERS.
The added example homepage cards/widgets are for README and i18guide only, and no installable
example card/widget for github.files_check.license and github.files_check.codeowners is included
in the PR changes.

An installable example Scorecard card is available for LICENSE and CODEOWNERS checks
workspaces/scorecard/packages/app-legacy/src/App.tsx[220-279]
workspaces/scorecard/plugins/scorecard/src/alpha/extensions/homePageCards.tsx[50-56]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Compliance requires an installable example Scorecard card for both `LICENSE` and `CODEOWNERS`, but the PR only adds example cards/widgets for `README` and `i18guide`.

## Issue Context
The PR introduces `github.files_check.*` and adds example homepage cards/widgets. To satisfy the checklist, provide installable example card/widget configurations specifically for `github.files_check.license` and `github.files_check.codeowners`.

## Fix Focus Areas
- workspaces/scorecard/packages/app-legacy/src/App.tsx[220-279]
- workspaces/scorecard/plugins/scorecard/src/alpha/extensions/homePageCards.tsx[50-56]
- workspaces/scorecard/plugins/scorecard/src/alpha/extensions/homePageCards.tsx[145-186]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Description

PullMetricsByProviderTask skips disabled-metric checks for batch providers, so metrics disabled via
scorecard.disabledMetrics or scorecard.io/disabled-metrics are still calculated and written to the
DB. This breaks the existing disable mechanism for github.files_check.* and any future batch
providers.

Code

workspaces/scorecard/plugins/scorecard-backend/src/scheduler/tasks/PullMetricsByProviderTask.ts[R146-214]

+            // Handle batch providers
+            if (isBatchProvider && provider.calculateMetrics) {
+              const entityRef = stringifyEntityRef(entity);
+              const entityKind = normalizeField(entity.kind);
+              const entityNamespace = normalizeField(entity.metadata.namespace);
+              const entityOwner = normalizeOwnerRef(entity?.spec?.owner);
+
+              try {
+                const resultsMap = await provider.calculateMetrics(entity);
+
+                // Create a result for each metric ID
+                return metricIds.map(metricId => {
+                  const value = resultsMap.get(metricId)!;
+
+                  try {
+                    const thresholds = mergeEntityAndProviderThresholds(
+                      entity,
+                      provider,
+                    );
+
+                    const status =
+                      this.thresholdEvaluator.getFirstMatchingThreshold(
+                        value,
+                        metricType,
+                        thresholds,
+                      );
+
+                    return {
+                      catalog_entity_ref: entityRef,
+                      metric_id: metricId,
+                      value,
+                      timestamp: new Date(),
+                      status,
+                      entity_kind: entityKind,
+                      entity_namespace: entityNamespace,
+                      entity_owner: entityOwner,
+                    } as DbMetricValueCreate;
+                  } catch (error) {
+                    return {
+                      catalog_entity_ref: entityRef,
+                      metric_id: metricId,
+                      value,
+                      timestamp: new Date(),
+                      error_message:
+                        error instanceof Error ? error.message : String(error),
+                      entity_kind: entityKind,
+                      entity_namespace: entityNamespace,
+                      entity_owner: entityOwner,
+                    } as DbMetricValueCreate;
+                  }
+                });
+              } catch (error) {
+                // If batch calculation fails, create error records for all metrics
+                return metricIds.map(
+                  metricId =>
+                    ({
+                      catalog_entity_ref: entityRef,
+                      metric_id: metricId,
+                      value: undefined,
+                      timestamp: new Date(),
+                      error_message:
+                        error instanceof Error ? error.message : String(error),
+                      entity_kind: entityKind,
+                      entity_namespace: entityNamespace,
+                      entity_owner: entityOwner,
+                    } as DbMetricValueCreate),
+                );
+              }
+            }

Evidence

The batch-provider code path creates metric values for every metricId returned by getMetricIds()
without consulting the disable rules, while the single-metric path explicitly calls
isMetricIdDisabled. The disable helper compares the provided metricId against app-config and entity
annotations, so batch providers must apply it per metricId (not just per provider).

workspaces/scorecard/plugins/scorecard-backend/src/scheduler/tasks/PullMetricsByProviderTask.ts[127-214]
workspaces/scorecard/plugins/scorecard-backend/src/scheduler/tasks/PullMetricsByProviderTask.ts[219-228]
workspaces/scorecard/plugins/scorecard-backend/src/utils/metricUtils.ts[31-56]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
Batch providers bypass the existing disabled-metric mechanism. As a result, metrics disabled in `scorecard.disabledMetrics` or via `scorecard.io/disabled-metrics` annotations are still computed and persisted.

### Issue Context
Single-metric providers call `isMetricIdDisabled(...)` before calculating/storing a metric; batch providers should apply the same logic *per metricId*.

### Fix Focus Areas
- workspaces/scorecard/plugins/scorecard-backend/src/scheduler/tasks/PullMetricsByProviderTask.ts[127-214]
- workspaces/scorecard/plugins/scorecard-backend/src/utils/metricUtils.ts[31-56]

### What to change
- In the batch-provider branch, filter `metricIds` per entity using `isMetricIdDisabled(this.config, metricId, entity, logger)`.
- Only create DB records for enabled metricIds.
- Ensure the behavior matches the single-provider branch (disabled metrics produce no record, same as returning `undefined`).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Description

PullMetricsByProviderTask logs a JSON dump of every metric value being stored at info level,
including entity refs and metric values/statuses. This can flood production logs and expose internal
scoring data on every scheduler run.

Code

workspaces/scorecard/plugins/scorecard-backend/src/scheduler/tasks/PullMetricsByProviderTask.ts[R283-297]

+        // Log summary of batch results for debugging, will remove before final PR
+        if (batchResults.length > 0) {
+          const summary = batchResults.map(r => ({
+            entity: r.catalog_entity_ref,
+            metric: r.metric_id,
+            value: r.value,
+            status: r.status,
+            ...(r.error_message && { error: r.error_message }),
+          }));
+          logger.info(
+            `Storing ${batchResults.length} metric values: ${JSON.stringify(
+              summary,
+            )}`,
+          );
+        }

Evidence

The task logs a full summarized payload for every processed batch right before database insertion,
and the log statement is unconditional when batchResults is non-empty (normal case).

workspaces/scorecard/plugins/scorecard-backend/src/scheduler/tasks/PullMetricsByProviderTask.ts[283-297]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`PullMetricsByProviderTask` logs per-entity metric values at `info` level, which is too verbose for normal operation and can leak internal data.

### Issue Context
This happens in the main scheduler loop and will run frequently in production.

### Fix Focus Areas
- workspaces/scorecard/plugins/scorecard-backend/src/scheduler/tasks/PullMetricsByProviderTask.ts[283-297]

### What to change
- Remove the log block entirely, or downgrade to `logger.debug(...)`.
- If you still need visibility, log only aggregate counts (e.g., number of entities processed, number of metric rows written, number of errors), not full per-entity details.
- Avoid `JSON.stringify(summary)` for large batches.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Description

GithubClient.checkFilesExist builds a repository selection set from configured files; when files is
empty it produces an empty selection set, which is invalid GraphQL and will throw at runtime. There
is already a unit test that calls this method with an empty map, so this edge case is expected to
work.

Code

workspaces/scorecard/plugins/scorecard-backend-module-github/src/github/GithubClient.ts[R96-116]

+    const aliasToMetricId = new Map<string, string>();
+    const fileChecksParts: string[] = [];
+
+    for (const [metricId, path] of files) {
+      const sanitizedAlias = this.sanitizeGraphQLAlias(metricId);
+
+      aliasToMetricId.set(sanitizedAlias, metricId);
+      fileChecksParts.push(
+        `${sanitizedAlias}: object(expression: "HEAD:${path}") { id }`,
+      );
+    }
+
+    const fileChecks = fileChecksParts.join('\n');
+
+    const query = `
+    query checkFilesExist($owner: String!, $repo: String!) {
+      repository(owner: $owner, name: $repo) {
+        ${fileChecks}
+      }
+    }
+  `;

Evidence

When no files are provided, fileChecksParts stays empty and the query interpolates an empty string
into repository { ... }, which results in an empty selection set. The test suite explicitly calls
checkFilesExist with an empty Map and expects an empty result map, implying this scenario should be
supported without calling GraphQL.

workspaces/scorecard/plugins/scorecard-backend-module-github/src/github/GithubClient.ts[96-116]
workspaces/scorecard/plugins/scorecard-backend-module-github/src/github/GitHubClient.test.ts[150-162]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
When `files.size === 0`, `checkFilesExist` still constructs and executes a GraphQL query that has an empty `repository {}` selection, which is invalid GraphQL.

### Issue Context
A unit test already exercises the empty-map case and expects an empty result map.

### Fix Focus Areas
- workspaces/scorecard/plugins/scorecard-backend-module-github/src/github/GithubClient.ts[89-116]
- workspaces/scorecard/plugins/scorecard-backend-module-github/src/github/GitHubClient.test.ts[150-162]

### What to change
- Add an early return at the start of `checkFilesExist`:
 - `if (files.size === 0) return new Map();`
- Update the unit test to assert the GraphQL client is **not** called when files is empty (optional but strengthens regression coverage).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools