JFrog Xray module

[bpmct]

A discussion dedicated to the JFrog Xray module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
13 / 25	18 / 20	N/A	10 / 10	75 / 100

Drilldown

Presentation & Onboarding — 13 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides two documented examples: local repository (default) and remote repository with use_cache_repo = true. Each has sensible defaults and clear context.
Coder-context framing	8	1	The README mentions Coder only in "Use the outputs to display security information as workspace metadata" and shows a coder_metadata resource. It does not explain what the module adds on top of Coder, nor does it frame where Coder fits in the JFrog Xray workflow. The module is essentially a Terraform data-fetcher with Coder-adjacent usage.
Visual preview	5	0	No image, GIF, or video in the README. The icon reference is metadata, not an embedded preview.

Credential Hygiene — 18 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	xray_token is marked sensitive = true in main.tf. README examples use var.artifactory_access_token and var.xray_token, avoiding inline secrets.
Non-hardcoded auth path	4	2	README shows using variables for tokens but does not document a path that avoids pasting raw keys into templates (e.g., ServiceAccount, IAM/OAuth, or external auth). The JFrog provider supports access tokens, but no alternative auth mechanism is documented. Half credit for variable-based approach.

Restricted-Environment Readiness — N/A

Criterion	Max	Score	Notes
Mirrorable artifact source	10	N/A	Module downloads nothing; it only queries the JFrog Xray API via the Terraform provider.
Bring-your-own binary	5	N/A	Module downloads nothing; it only queries the JFrog Xray API via the Terraform provider.
Egress transparency	3	N/A	Module downloads nothing; it only queries the JFrog Xray API via the Terraform provider.
Runs without sudo	2	N/A	Module has no scripts; it is pure Terraform configuration.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. xray_url has validation for URL format. image has validation for minimum path segments. Defaults are sensible (use_cache_repo = false, empty string overrides).
Test coverage	4	4	Comprehensive TypeScript tests in main.test.ts cover: required variable validation, local repository scan results, empty results handling, remote repository with cache behavior, and custom repo/path overrides. Mock servers simulate Xray API responses. Business logic is tested end-to-end.

Overall — 75 / 100

Raw 41 / 55 → round(41 / 55 × 100) = 75

(Utility module: Restricted-Environment Readiness N/A, normalized from 55-point denominator)

---

Scored against SCORECARD.md on 2026-07-15 with claude-sonnet-4-5.