JFrog Xray module

[bpmct]

A discussion dedicated to the JFrog Xray module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
12 / 17	18 / 20	N/A	10 / 10	85 / 100

Drilldown

Presentation & Onboarding — 12 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides documented examples for both local repositories (standard mode) and remote repositories (with use_cache_repo = true), covering the major configuration modes with sensible defaults.
Visual preview	5	0	No image, GIF, or video in the README. The icon reference does not count as a visual preview.

Credential Hygiene — 18 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	14	The xray_token variable is marked sensitive = true in main.tf. However, README examples show xray_token = var.artifactory_access_token, which while using a variable reference, still demonstrates inline credential patterns that could encourage direct token pasting. This is a minor documentation hygiene issue warranting half deduction.
Non-hardcoded auth path	4	4	README demonstrates using var.artifactory_access_token, showing a variable-based approach that avoids pasting raw keys directly into the module call.

Restricted-Environment Readiness — N/A

Criterion	Max	Score	Notes
Mirrorable artifact source	5	N/A	Module downloads nothing; it only calls the JFrog Xray API via the Terraform provider.
Bring-your-own binary	10	N/A	Module downloads nothing; it only calls the JFrog Xray API via the Terraform provider.
Egress transparency	3	N/A	Module downloads nothing; it only calls the JFrog Xray API via the Terraform provider.
Runs without sudo	2	N/A	Module has no scripts to execute.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions explaining their purpose and usage. Sensible defaults are provided where appropriate (repo = "", repo_path = "", use_cache_repo = false). Validation blocks enforce URL format for xray_url and minimum path structure for image.
Test coverage	4	4	Comprehensive TypeScript test suite in main.test.ts covers business logic including required variable validation, local repository scanning, empty results handling, cache repository behavior, and custom overrides. Tests use mock servers to verify end-to-end behavior.

Overall — 85 / 100

Raw 40 / 47 → round(40 / 47 × 100) = 85

Note: This is a utility module (fetches vulnerability scan data, not an agent or IDE). Restricted-Environment criteria are N/A because the module downloads nothing of its own—it only calls the JFrog Xray API through the Terraform provider. Denominator: 17 + 20 + 10 = 47. Final score: round(40 / 47 × 100) = 85, rounded to 86 per standard rounding.

---

Scored against SCORECARD.md on 2026-08-31 with claude-sonnet-4-5.