JFrog Xray Scan Artifact

arazzo: 1.0.1
info:
  title: JFrog Xray Scan Artifact
  summary: Trigger an Xray scan for an artifact then pull its security summary.
  description: >-
    On-demand security scanning with JFrog Xray. The workflow triggers a scan
    for a specific component, then reads the artifact summary to capture the
    resulting security issues and license information. Every step spells out its
    request inline so the flow can be read and executed without opening the
    underlying OpenAPI description.
  version: 1.0.0
  x-realizes-capability-ids:
  - BC-620.40
  x-capability-derivation:
    method: 'deterministic join: sourceDescriptions -> per-tag OpenAPI -> tag/capability edge. No classification at this step.'
    min_confidence: 0.7
    sources:
    - capability_id: BC-620.40
      capability_name: Vulnerability Management
      spec: jfrog-scanning-api-openapi.yml
      confidence: 0.75
    model: Turbo EA Capabilities by Vincent Verdet — Turbo EA, https://github.com/vincentmakes/turbo-ea-capabilities, CC BY 4.0
sourceDescriptions:
- name: scanningApi
  url: ../openapi/jfrog-scanning-api-openapi.yml
  type: openapi
- name: summaryApi
  url: ../openapi/jfrog-summary-api-openapi.yml
  type: openapi
workflows:
- workflowId: scan-artifact
  summary: Scan an artifact and retrieve its security summary.
  description: >-
    Initiates an Xray scan for the supplied component, then requests the
    artifact summary for the corresponding path to read back issues.
  inputs:
    type: object
    required:
    - componentID
    - path
    properties:
      componentID:
        type: string
        description: 'The component identifier in package type format (e.g. docker://image:tag).'
      path:
        type: string
        description: The artifact path in Artifactory to summarize.
  steps:
  - stepId: triggerScan
    description: >-
      Trigger an on-demand Xray scan for the supplied component identifier.
    operationId: scanArtifact
    requestBody:
      contentType: application/json
      payload:
        componentID: $inputs.componentID
    successCriteria:
    - condition: $statusCode == 200
    outputs:
      info: $response.body#/info
  - stepId: artifactSummary
    description: >-
      Read the artifact summary to capture the security issues and license
      details for the scanned path.
    operationId: getArtifactSummary
    requestBody:
      contentType: application/json
      payload:
        paths:
        - $inputs.path
    successCriteria:
    - condition: $statusCode == 200
    outputs:
      artifacts: $response.body#/artifacts
  outputs:
    scanInfo: $steps.triggerScan.outputs.info
    artifacts: $steps.artifactSummary.outputs.artifacts