JFrog Xray module

[bpmct]

A discussion dedicated to the JFrog Xray module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
13 / 25	18 / 20	N/A	10 / 10	75 / 100

Drilldown

Presentation & Onboarding — 13 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides two documented examples: standard local repository usage and remote repository usage with use_cache_repo = true. Each example includes sensible defaults and clear context for when to use each mode.
Coder-context framing	8	1	The README mentions Coder only in "Use the outputs to display security information as workspace metadata" and shows a coder_metadata resource. It does not explain what the module adds on top of Coder, does not name JFrog Xray in relation to Coder's workflow, and does not show where Coder fits in the security scanning flow. Minimal Coder context.
Visual preview	5	0	No image, GIF, or video in the README. The icon reference icon: ../../../../.icons/jfrog-xray.svg is metadata, not an embedded visual preview.

Credential Hygiene — 18 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	14	The xray_token variable is marked sensitive = true in main.tf. However, README examples show xray_token = var.artifactory_access_token, which while using a variable reference, the variable description in main.tf provides explicit token generation instructions that could encourage inline secrets. The examples avoid literal inline secrets but the pattern is not perfectly clean.
Non-hardcoded auth path	4	4	The README documents using JFrog access tokens, which is the standard JFrog authentication mechanism. The variable description explicitly guides users to "User Management > Access Tokens" for token generation, showing a proper auth path.

Restricted-Environment Readiness — N/A

Criterion	Max	Score	Notes
Mirrorable artifact source	10	N/A	This module downloads nothing. It only queries the JFrog Xray API using the Terraform provider. No artifacts are fetched or installed.
Bring-your-own binary	5	N/A	This module downloads nothing. It only queries the JFrog Xray API using the Terraform provider. No binaries are involved.
Egress transparency	3	N/A	This module downloads nothing. It only queries the JFrog Xray API using the Terraform provider. The only external endpoint is the user-provided xray_url.
Runs without sudo	2	N/A	This module contains no scripts. It only uses Terraform data sources and outputs.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear, detailed descriptions. xray_url has validation for URL format. image has validation for minimum path segments. Defaults are sensible (use_cache_repo = false, repo = "", repo_path = ""). Descriptions explain when and why to use each variable.
Test coverage	4	4	Comprehensive TypeScript test suite in main.test.ts covers: required variable validation (3 tests), local repository scanning, empty results handling, cache repo behavior, and custom repo/path overrides. Tests use mock servers to simulate different Xray API responses. Business logic for parsing image paths and selecting scan results is tested end-to-end.

Overall — 75 / 100

Raw 41 / 55 → round(41 / 55 × 100) = 75

(Utility module: Restricted-Environment Readiness excluded as N/A, normalized from 75-point denominator)

---

Scored against SCORECARD.md on 2026-08-03 with claude-sonnet-4-5.