Hey folks! 👋 Ever feel like you're racing ahead with your CI/CD pipeline, pushing out builds like crazy with Jenkins and Artifactory, but the security scanning part feels like it's bolted on as an afterthought? That was us, until we really dug into integrating JFrog Xray into our high-velocity workflow.
We were using a couple of different CLI scanning tools in our Jenkins pipelines, and while they worked, the experience was fragmented. The big "aha" moment came when we realized Xray isn't just a scanner—it's a policy engine deeply integrated with Artifactory. This means you can **block** promotion of vulnerable builds right at the repository level, which is a game-changer for enforcement.
Here’s a snippet from our declarative Jenkins pipeline that shows the integration point. The key is that the scan and the policy decision happen *outside* of Jenkins, keeping the pipeline clean.
```groovy
stage('Security Scan & Promote') {
steps {
// Build and push to Artifactory...
sh 'mvn clean deploy -DskipTests' // Tests already ran earlier
// This is where Xray takes over automatically.
// We have a watch set on our 'staging-docker-local' repo that triggers a scan.
// The promotion step below only proceeds if Xray gives the all-clear based on our policy.
script {
def promotionConfig = '''
{
"sourceRepo": "staging-docker-local",
"targetRepo": "production-docker-local",
"status": "promoted",
"failFast": true
}
'''
// This Artifactory promotion REST call will fail if Xray finds a violation.
sh "curl -H 'Authorization: Bearer ${ARTIFACTORY_TOKEN}' -X POST ${ARTIFACTORY_URL}/api/build/promote/my-build/${env.BUILD_NUMBER} -H 'Content-Type: application/json' -d '${promotionConfig}'"
}
}
}
```
The real power, in my opinion, comes from setting up **watches and policies**. You can get super granular. For example, our policy for production-ready images looks like this:
* **Block if:** Any Critical or High severity CVEs are found (with exceptions for certain legacy internal libs we track).
* **Warn & continue in Jenkins log if:** Any Medium severity CVEs are found, but we allow a 30-day grace period for teams to fix them.
* **Auto-allow:** All Low severity issues (we review them monthly in our security guild).
The **gotchas** we hit (and you might too):
* **Database maintenance:** Xray's performance on a huge Artifactory instance depends on its internal DB. Schedule regular maintenance windows for vacuum/cleanup ops, especially if you have a massive number of artifacts.
* **Initial scan backlog:** When you first set up watches on existing repositories, the scan queue can get huge. We learned to start with a few key repos and expand gradually.
* **CI plugin vs. native integration:** We tried the Jenkins Xray plugin initially, but found the direct Artifactory promotion API (as shown above) gave us more flexibility and control over the pipeline's flow and error handling.
For a team already invested in the JFrog ecosystem, it feels like the most *integrated* security tool you can get. It turns security from a manual gate into a native, automated policy layer. The detail-oriented part of me loves how every artifact's security state is just a property of the artifact itself, traceable forever.
Would love to hear how others have structured their policies, or if you've found clever ways to manage the scan load in massive mono-repo setups!
-- Ian
Integration Ian