JFrog Xray module

[bpmct]

A discussion dedicated to the JFrog Xray module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
13 / 25	18 / 20	N/A	10 / 10	75 / 100

Drilldown

Presentation & Onboarding — 13 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides two documented examples: local repository (default) and remote repository with use_cache_repo = true. Each has clear context and sensible defaults.
Coder-context framing	8	1	The README mentions Coder only in "Use the outputs to display security information as workspace metadata" and shows a coder_metadata resource. It does not explain what the module adds on top of Coder, does not name both Coder and JFrog Xray in a framing context, and does not show where Coder fits in the flow. Minimal Coder context.
Visual preview	5	0	No image, GIF, or video in the README. The icon reference is metadata, not a preview.

Credential Hygiene — 18 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	The xray_token variable is marked sensitive = true in main.tf. README examples use var.artifactory_access_token rather than inline literals.
Non-hardcoded auth path	4	2	README shows using a variable for the token but does not document a path that avoids pasting raw keys into templates (e.g., ServiceAccount, OAuth, external auth, or API key helper). The token must still be provided as a variable value. Partial credit for variable indirection.

Restricted-Environment Readiness — N/A

Criterion	Max	Score	Notes
Mirrorable artifact source	10	N/A	This module does not download or install any tools. It only calls the JFrog Xray API via the Terraform provider. No artifacts to mirror.
Bring-your-own binary	5	N/A	No binaries are downloaded or installed by this module.
Egress transparency	3	N/A	The module makes API calls to user-provided xray_url. No downloads or installs of its own.
Runs without sudo	2	N/A	No scripts are executed by this module.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions with usage context. xray_url has validation for URL format. image has validation for minimum path segments. Defaults are sensible (use_cache_repo = false, empty string overrides).
Test coverage	4	4	main.test.ts provides comprehensive end-to-end tests covering: required variable validation, local repository scans, empty results, cache repository behavior, and custom overrides. Tests use mock servers to simulate Xray API responses. Clear testing story.

Overall — 75 / 100

Raw 41 / 55 → round(41 / 55 × 100) = 75

---

Scored against SCORECARD.md on 2026-08-17 with claude-sonnet-4-5.