JFrog Xray module

[bpmct]

A discussion dedicated to the JFrog Xray module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
13 / 25	18 / 20	N/A	10 / 10	75 / 100

Drilldown

Presentation & Onboarding — 13 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides documented examples for both local repositories (standard mode) and remote repositories (cache mode with use_cache_repo = true), each with sensible defaults and clear explanations of when to use each mode.
Coder-context framing	8	1	README mentions Coder only in the opening sentence ("Use the outputs to display security information as workspace metadata") and shows coder_metadata usage, but does not explain what the module adds on top of Coder, does not name JFrog Xray in context of Coder's workflow, and does not show where Coder fits in the security scanning flow. Minimal Coder-context framing.
Visual preview	5	0	No image, GIF, or video in README. Only an icon reference in frontmatter.

Credential Hygiene — 18 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	The xray_token variable is marked sensitive = true in main.tf. README examples use var.artifactory_access_token rather than inline literal secrets.
Non-hardcoded auth path	4	2	README shows using a variable for the token (var.artifactory_access_token) but does not document any path that avoids pasting keys into templates entirely, such as ServiceAccount, IAM/OAuth, or external auth mechanisms. The documented approach still requires the token to be provided as a Terraform variable. Partial credit for variable-based approach.

Restricted-Environment Readiness — N/A

Criterion	Max	Score	Notes
Mirrorable artifact source	10	N/A	Module downloads nothing; it only queries the JFrog Xray API using user-provided URLs. No artifacts are downloaded or installed.
Bring-your-own binary	5	N/A	Module downloads nothing; it only queries the JFrog Xray API. No binary installation occurs.
Egress transparency	3	N/A	Module downloads nothing; it only queries the JFrog Xray API at the user-provided xray_url. No module-controlled external endpoints.
Runs without sudo	2	N/A	Module contains no scripts; it only uses Terraform data sources and providers.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear, detailed descriptions explaining their purpose and usage. Sensible defaults provided where appropriate (repo = "", repo_path = "", use_cache_repo = false). Validation blocks present for xray_url (URL format check) and image (path structure check).
Test coverage	4	4	Comprehensive TypeScript test suite in main.test.ts covers business logic end-to-end: validates required variables, tests local repository scanning, remote repository cache behavior, empty results handling, and custom repo/path overrides. Mock servers simulate different Xray API responses. Clear testing story.

Overall — 75 / 100

Raw 41 / 55 → round(41 / 55 × 100) = 75

---

Scored against SCORECARD.md on 2026-07-27 with claude-sonnet-4-5.