JFrog Xray module

[bpmct]

A discussion dedicated to the JFrog Xray module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
12 / 17	18 / 20	N/A	10 / 10	85 / 100

Drilldown

Presentation & Onboarding — 12 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides clear examples for both local repositories (standard mode) and remote repositories (with use_cache_repo = true), covering the major configuration modes with sensible defaults.
Visual preview	5	0	No image, GIF, or video is embedded in the README. The icon reference does not count as a visual preview.

Credential Hygiene — 18 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	14	The xray_token variable is marked sensitive = true in main.tf. However, README examples show xray_token = var.artifactory_access_token, which while using a variable reference, still demonstrates inline credential patterns that could encourage direct token pasting. This is better than literal tokens but not ideal, earning 14/16.
Non-hardcoded auth path	4	4	README demonstrates using Terraform variables for token management (var.artifactory_access_token), which is a reasonable path that avoids pasting raw keys directly into templates.

Restricted-Environment Readiness — N/A

Criterion	Max	Score	Notes
Mirrorable artifact source	5	N/A	This module does not download or install any tools. It only calls the JFrog Xray API via the Terraform provider.
Bring-your-own binary	10	N/A	No binary installation occurs; the module uses the Terraform provider to make API calls.
Egress transparency	3	N/A	No downloads or installs occur. The module makes API calls to user-specified xray_url, which is inherently transparent.
Runs without sudo	2	N/A	No scripts are executed by this module.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear, detailed descriptions explaining their purpose and usage. Sensible defaults are provided where appropriate (repo = "", repo_path = "", use_cache_repo = false). Validation blocks ensure xray_url is a valid URL and image has proper format.
Test coverage	4	4	Comprehensive TypeScript test suite in main.test.ts covers business logic including required variable validation, local repository scanning, remote repository with cache behavior, empty results handling, and custom repo/path overrides. Tests use mock servers to verify end-to-end behavior.

Overall — 85 / 100

Raw 40 / 47 → round(40 / 47 × 100) = 85

Wait, recalculating: Universal criteria applicable = 17 + 20 + 0 (all N/A) + 10 = 47 points max.
Scored: 12 + 18 + 0 + 10 = 40 points.
This is a Utility module, so: round(40 / 47 × 100) = round(85.11) = 85 / 100

---

Scored against SCORECARD.md on 2026-09-14 with claude-sonnet-4-5.