I am evaluating SCA and license compliance tools for a small development team (under 10 developers). Our current stack is exclusively GitHub for source control and JFrog Artifactory for artifact management. We do not use any other JFrog products.
Given that we are already paying for Artifactory, Xray seems like the integrated candidate. However, GitHub Dependabot is already included in our GitHub subscription. My preliminary research highlights several points, but I am seeking practical experience from teams with a similar setup.
Key considerations for our compliance requirements (SOX, data residency):
* **Scan Coverage:** Dependabot scans the source repository. Xray scans binaries in Artifactory. For a true SBOM and audit trail, scanning the final deployed artifact seems more accurate. Does this distinction matter in practice for audit evidence?
* **License Compliance:** We require clear policy violations and license dependency graphs. My tests show Xray provides more granular policy rules, but Dependabot's reporting may be sufficient for our scale.
* **Operational Overhead:** Xray would require additional configuration and policy management within our Artifactory instance. Dependabot is essentially configuration-free but operates in a different domain (GitHub vs. Artifactory).
* **Cost:** Xray is a significant additional cost. Dependabot is effectively "free" for us. The question is whether Xray's deeper integration and binary-level analysis justify the expense for a small team.
Has anyone conducted a similar comparison specifically for a compliance-focused environment? I am particularly interested in:
- Handling of transitive dependencies in binaries versus source.
- Efficiency of access reviews and audit reporting.
- Any gaps in Dependabot's ability to meet formal compliance audit requirements compared to a dedicated tool like Xray.