JFrog Xray module

[bpmct]

A discussion dedicated to the JFrog Xray module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
12 / 17	18 / 20	N/A	10 / 10	85 / 100

Drilldown

Presentation & Onboarding — 12 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides clear examples for both local repositories (standard mode) and remote repositories (with use_cache_repo = true), covering the major configuration modes with sensible defaults.
Visual preview	5	0	No image, GIF, or video is embedded in the README. The icon reference does not count as a visual preview.

Credential Hygiene — 18 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	The xray_token variable is marked sensitive = true. README examples use var.artifactory_access_token rather than inline literal secrets.
Non-hardcoded auth path	4	2	README shows using a variable for the token but does not document alternative auth paths like OAuth, IAM roles, or external auth mechanisms. The approach shown is direct token-based authentication.

Restricted-Environment Readiness — N/A

Criterion	Max	Score	Notes
Mirrorable artifact source	5	N/A	Module does not download or install any tools; it only calls the JFrog Xray API via the Terraform provider.
Bring-your-own binary	10	N/A	Module does not download or install any tools; it only calls the JFrog Xray API via the Terraform provider.
Egress transparency	3	N/A	Module does not download or install any tools; it only calls the JFrog Xray API via the Terraform provider.
Runs without sudo	2	N/A	Module contains no scripts to execute.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear, detailed descriptions explaining their purpose and usage. Sensible defaults are provided where appropriate (repo, repo_path, use_cache_repo). Validation rules are present for xray_url (URL format) and image (path structure).
Test coverage	4	4	Comprehensive TypeScript test suite in main.test.ts covers business logic including required variable validation, local repository scanning, remote repository with cache behavior, empty results handling, and custom repo/path overrides. Tests use mock servers to simulate different Xray API responses.

Overall — 85 / 100

Raw 40 / 47 → round(40 / 47 × 100) = 85

Wait, recalculating: This is a Utility module (fetches vulnerability scan results, not an agent or IDE).

Universal criteria available: 17 + 20 + 20 + 10 = 67 points maximum
Restricted-Environment is N/A (all 20 points excluded)
Denominator: 67 - 20 = 47 points

Score: 12 + 18 + 10 = 40 points
Normalized: round(40 / 47 × 100) = round(85.11) = 85

Correction to table:

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
12 / 17	18 / 20	N/A	10 / 10	85 / 100

Drilldown

Presentation & Onboarding — 12 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides clear examples for both local repositories (standard mode) and remote repositories (with use_cache_repo = true), covering the major configuration modes with sensible defaults.
Visual preview	5	0	No image, GIF, or video is embedded in the README. The icon reference does not count as a visual preview.

Credential Hygiene — 18 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	The xray_token variable is marked sensitive = true. README examples use var.artifactory_access_token rather than inline literal secrets.
Non-hardcoded auth path	4	2	README shows using a variable for the token but does not document alternative auth paths like OAuth, IAM roles, or external auth mechanisms. The approach shown is direct token-based authentication.

Restricted-Environment Readiness — N/A

Criterion	Max	Score	Notes
Mirrorable artifact source	5	N/A	Module does not download or install any tools; it only calls the JFrog Xray API via the Terraform provider.
Bring-your-own binary	10	N/A	Module does not download or install any tools; it only calls the JFrog Xray API via the Terraform provider.
Egress transparency	3	N/A	Module does not download or install any tools; it only calls the JFrog Xray API via the Terraform provider.
Runs without sudo	2	N/A	Module contains no scripts to execute.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear, detailed descriptions explaining their purpose and usage. Sensible defaults are provided where appropriate (repo, repo_path, use_cache_repo). Validation rules are present for xray_url (URL format) and image (path structure).
Test coverage	4	4	Comprehensive TypeScript test suite in main.test.ts covers business logic including required variable validation, local repository scanning, remote repository with cache behavior, empty results handling, and custom repo/path overrides. Tests use mock servers to simulate different Xray API responses.

Overall — 85 / 100

---

Scored against SCORECARD.md on 2026-09-21 with claude-sonnet-4-5.