@jentic/api-scorecard-cli 1.0.0-alpha.1 → 1.0.0-alpha.11
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +21 -1
- package/package.json +2 -2
package/README.md
CHANGED
|
@@ -85,7 +85,7 @@ npx @jentic/api-scorecard-cli@alpha score --detail diagnostics ./openapi.yaml
|
|
|
85
85
|
|
|
86
86
|
## Anonymous vs keyed access
|
|
87
87
|
|
|
88
|
-
OpenAPI documents
|
|
88
|
+
OpenAPI documents from [Jentic Public APIs (OAK)](https://github.com/jentic/jentic-public-apis)
|
|
89
89
|
score without any key. For everything else, set the MVP preview key:
|
|
90
90
|
|
|
91
91
|
```bash
|
|
@@ -95,6 +95,26 @@ export JENTIC_API_KEY=mvp-preview
|
|
|
95
95
|
This is a documented public placeholder for the alpha preview — not a secret. Real key issuance
|
|
96
96
|
arrives in a future release.
|
|
97
97
|
|
|
98
|
+
## Verifying releases
|
|
99
|
+
|
|
100
|
+
`@jentic/api-scorecard-cli` alpha tarballs ship with two Sigstore-signed attestations:
|
|
101
|
+
npm provenance (where and how the tarball was built) and an SPDX 2.3 SBOM (the runtime
|
|
102
|
+
dependency closure). Both are present from `1.0.0-alpha.7` onward; earlier alphas carry only
|
|
103
|
+
provenance. Verify with the GitHub CLI:
|
|
104
|
+
|
|
105
|
+
```bash
|
|
106
|
+
npm pack @jentic/api-scorecard-cli@alpha
|
|
107
|
+
|
|
108
|
+
# Verify provenance (gh's default predicate)
|
|
109
|
+
gh attestation verify ./jentic-api-scorecard-cli-*.tgz --owner jentic
|
|
110
|
+
|
|
111
|
+
# Verify the SBOM (non-default predicate, must be requested explicitly)
|
|
112
|
+
gh attestation verify ./jentic-api-scorecard-cli-*.tgz --owner jentic \
|
|
113
|
+
--predicate-type https://spdx.dev/Document/v2.3
|
|
114
|
+
```
|
|
115
|
+
|
|
116
|
+
Each successful run reports `Loaded digest sha256:…` and lists the matching attestation.
|
|
117
|
+
|
|
98
118
|
## Status
|
|
99
119
|
|
|
100
120
|
This project is in **alpha**. Track progress in
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@jentic/api-scorecard-cli",
|
|
3
|
-
"version": "1.0.0-alpha.
|
|
3
|
+
"version": "1.0.0-alpha.11",
|
|
4
4
|
"description": "Score an OpenAPI document against the Jentic API AI Readiness Framework (JAIRF).",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"api",
|
|
@@ -62,5 +62,5 @@
|
|
|
62
62
|
"engines": {
|
|
63
63
|
"node": ">=20.10.0"
|
|
64
64
|
},
|
|
65
|
-
"gitHead": "
|
|
65
|
+
"gitHead": "6970c0d53d9d404f9822163013b81cf2561c60ce"
|
|
66
66
|
}
|