ajeetraina777/jfrog-xray-kit:0.1.1-smoke

schemaVersion: "2"
kind: mixin
name: jfrog-xray
displayName: JFrog Xray (smoke-test build)
description: Installs the JFrog CLI (jf), pre-wired to your JFrog Platform, so agents can run Xray security & license scans (jf audit / jf scan / jf docker scan) against dependencies, binaries, and container images. Xray is a core component of the JFrog Platform and shares package metadata with Artifactory, so a scan reports not just a CVE but its full impact path through your dependency graph.
licenses:
    - Apache-2.0
args:
    jfrog_host:
        default: example.jfrog.io
        description: Your JFrog Platform host, e.g. mycompany.jfrog.io (SaaS) or artifactory.internal.example.com (self-hosted). Hostname only — no scheme, no path, no port.
        pattern: ^[a-z0-9]([a-z0-9.-]{0,251}[a-z0-9])?$
agentInstructions:
    content: |
        ## JFrog Xray

        The JFrog CLI `jf` is installed and pre-wired to your JFrog Platform:
        `JF_URL` points at your instance and `JF_ACCESS_TOKEN` is a **proxy-managed
        placeholder** — never the real token. The sandbox proxy injects the real
        value on outbound requests to your JFrog host, so there is no `jf config add`
        step and the token never lives inside the sandbox.

        Xray is the JFrog Platform's security & compliance engine. Because it shares
        package metadata with Artifactory, a scan reports not just a CVE but its full
        impact path through your dependency graph — enabling real risk assessment and
        remediation, not just a flat vulnerability list.

        Common scans:
        - `jf audit` — scan the current project's declared dependencies (npm, pip,
          Go, Maven, Gradle, NuGet, …) for vulnerabilities and license violations.
        - `jf audit --licenses` — also report license-compliance results.
        - `jf audit --format=json` — machine-readable output you can parse.
        - `jf scan <path>` — scan an arbitrary file, folder, or binary.
        - `jf docker scan <image>` — scan a local container image.
        - `jf build-scan <build-name> <build-number>` — scan a published build.

        Verify connectivity with `jf rt ping`; inspect config with `jf config show`.
        If a scan reports "Xray is not entitled", the token lacks Xray scopes or the
        platform doesn't have Xray enabled.
permissions:
    network:
        allow:
            - releases.jfrog.io
            - ${{ kit.args.jfrog_host }}
credentials:
    - service: jfrog
      description: JFrog Platform access token (needs Xray read + scan scopes). Stored on the host; the sandbox only ever sees a placeholder, and the proxy injects the real value on outbound requests to your JFrog host.
      apiKey:
        name: JF_ACCESS_TOKEN
        inject:
            - domain: ${{ kit.args.jfrog_host }}
              header: Authorization
              format: Bearer %s
environment:
    variables:
        JF_URL: https://${{ kit.args.jfrog_host }}
        JFROG_CLI_AVOID_NEW_VERSION_WARNING: "true"
        JFROG_CLI_OFFER_CONFIG: "false"
setup:
    install:
        - command: |
            set -euo pipefail
            JF_VERSION=2.121.0
            ARCH=$(dpkg --print-architecture)
            case "$ARCH" in
              amd64) SHA256="7d9fcfd1d21d779cf18e96a0ae97706c6d15808ff79a8fa1b91f046d0fd419ca" ;;
              arm64) SHA256="1858ad5e2acfcaecb5da5b5f623cd667b85cce33b59181d60384dc5f42908351" ;;
              *) echo "unsupported sandbox arch: $ARCH (expected amd64 or arm64)" >&2; exit 1 ;;
            esac
            URL="https://releases.jfrog.io/artifactory/jfrog-cli/v2-jf/${JF_VERSION}/jfrog-cli-linux-${ARCH}/jf"
            curl --proto '=https' --tlsv1.2 -fsSL -o /tmp/jf "$URL"
            echo "${SHA256}  /tmp/jf" | sha256sum -c -
            install -m 0755 /tmp/jf /usr/local/bin/jf
            rm -f /tmp/jf
            jf --version
          user: "0"
          description: Install JFrog CLI (jf) v2.121.0, version+digest pinned