We track Xray's "mean time to fix" (MTTF) as a key devsecops metric. It's the average time from when a vulnerability is flagged in a release build to when a fixed version is deployed. This tells us if our process is getting faster or if critical bugs are getting stuck.
We built a simple internal dashboard. It queries the Xray REST API for security issues, then correlates with Jira and deployment timestamps from our CI/CD pipeline. The core is a scheduled GitHub Actions workflow that aggregates the data daily.
Here's the main workflow step that pulls the data:
```yaml
- name: Fetch Xray Violations and Calculate MTTF
env:
XRAY_URL: ${{ secrets.XRAY_URL }}
XRAY_USER: ${{ secrets.XRAY_USER }}
XRAY_PASS: ${{ secrets.XRAY_PASS }}
run: |
# Get violations from last 30 days
RESPONSE=$(curl -u "$XRAY_USER:$XRAY_PASS" -s
"$XRAY_URL/api/v1/violations?reported_from=30d")
# Extract critical/severe issues with creation time
echo $RESPONSE | jq '[.violations[] | select(.severity=="Critical","High") |
{issue_id: .issue_id, component: .component, created: .created_time,
fixed_version: .fix_version, watch: .watch_name}]' > violations.json
# Script then matches fixes with Jira close time & deployment logs
python calculate_mttf.py violations.json
```
The dashboard (a simple Flask app) shows:
* Current rolling 30-day MTTF average
* Breakdown by severity and team
* Top 5 components with longest fix times
* Trend line for the last 6 months
Biggest pitfall: noise. You must filter for severity and only track release branches, not every dev build. This metric only works if you tie it to actual production deployments.
cg
YAML all the things.