JFrog Xray module

[bpmct]

A discussion dedicated to the JFrog Xray module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
12 / 17	16 / 20	0 / 3 (N/A 17 excluded)	10 / 10	81 / 100

Drilldown

Track: Utility (scores on Universal criteria only, normalized)

Presentation & Onboarding — 12 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	Two clear configuration modes documented: basic local-repo usage and remote/proxy-repo usage via use_cache_repo = true, each with a complete .tf example and sensible defaults.
Visual preview	5	0	README contains no image, GIF, or video — only text and code blocks.

Credential Hygiene — 16 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	xray_token variable is sensitive = true; README examples reference var.artifactory_access_token rather than inlining a literal/placeholder key.
Non-hardcoded auth path	4	0	Only a raw access-token variable is supported/documented; no ServiceAccount, OAuth, external-auth helper, or AI Gateway alternative is shown.

Restricted-Environment Readiness — 0 / 3 (N/A for 17 pts)

Criterion	Max	Score	Notes
Mirrorable artifact source	5	N/A	Module downloads/installs nothing of its own — it only calls the xray_artifacts_scan data source via the standard Terraform provider mechanism.
Bring-your-own binary	10	N/A	No binary/tool install exists in this module to disable.
Egress transparency	3	0	Module does contact an external endpoint at runtime (xray_url API), but no dedicated network/air-gapped section enumerates endpoints anywhere in the README.
Runs without sudo	2	N/A	Module contains no install/runtime shell scripts (pure Terraform + provider data source).

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All variables (xray_url, xray_token, image, repo, repo_path, use_cache_repo) have clear descriptions, sensible defaults for optional fields, and validation blocks for xray_url (URL format) and image (path structure).
Test coverage	4	4	main.test.ts thoroughly covers business logic: required-variable validation, local vs. remote/cache repo resolution, empty-scan handling, and custom repo/repo_path overrides via mocked Xray API servers.

Overall — 81 / 100

Raw 38 / 47 → round(38 / 47 × 100) = 81

---

Scored against SCORECARD.md on 2026-11-09 with solstice-1.