JFrog Xray module

[bpmct]

A discussion dedicated to the JFrog Xray module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
13 / 25	18 / 20	N/A	10 / 10	75 / 100

Drilldown

Presentation & Onboarding — 13 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides two documented examples: local repository (default) and remote repository with use_cache_repo = true. Each has clear context and sensible defaults.
Coder-context framing	8	1	The README mentions Coder only in "Use the outputs to display security information as workspace metadata" and shows a coder_metadata resource. It does not explain what the module adds on top of Coder, does not name both Coder and JFrog Xray in a framing context, and does not show where Coder fits in the flow. Minimal Coder context.
Visual preview	5	0	No image, GIF, or video in the README. The icon reference is metadata, not a preview.

Credential Hygiene — 18 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	The xray_token variable is marked sensitive = true in main.tf. README examples use var.artifactory_access_token rather than inline literals.
Non-hardcoded auth path	4	2	README shows using a variable for the token but does not document a path that avoids pasting raw keys into templates (e.g., ServiceAccount, IAM/OAuth, or external auth). The token must still be provided as a variable value. Partial credit for variable indirection.

Restricted-Environment Readiness — N/A

Criterion	Max	Score	Notes
Mirrorable artifact source	10	N/A	This module downloads nothing; it only queries the JFrog Xray API via the Terraform provider. The xray_url variable configures the API endpoint, not a download source.
Bring-your-own binary	5	N/A	No installation or binary download occurs.
Egress transparency	3	N/A	No downloads or installs; the module only makes API calls to the user-provided xray_url.
Runs without sudo	2	N/A	No scripts are executed by this module.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. xray_url has validation for URL format. image has validation for minimum path segments. Defaults are sensible (use_cache_repo = false, empty string overrides).
Test coverage	4	4	Comprehensive TypeScript tests in main.test.ts cover business logic: required variable validation, local repository scanning, empty results handling, cache repo behavior, and custom overrides. Mock servers simulate API responses. Clear testing story.

Overall — 75 / 100

Raw 41 / 55 → round(41 / 55 × 100) = 75

---

Scored against SCORECARD.md on 2026-08-10 with claude-sonnet-4-5.