How jfrog/frogbot works
Frogbot is a Git security bot with two main workflows: assess proposed pull-request changes and periodically scan repositories to open remediation pull requests. Its documented scans cover dependency vulnerabilities and license compliance, contextual analysis, SAST, secrets, and IaC. The graph includes the GitHub Action entry point, CLI dispatch, scan and fix workflows, and shared reporting/Git layers. Some command wiring and scanner internals were not sampled, so uncertain connections are omitted.
Main entry points: scanrepository.go Repository scan · scanpullrequest.go Pull request scan · main.ts Action event router · autopr.go Auto-fix PR
Components 16
Entry points
- Action event router
action/src/main.ts - CLI command dispatch
main.go - Command definitions
commands.go
Security scanning
- Pull request scan
scanpullrequest/scanpullrequest.go - Repository scan
scanrepository/scanrepository.go - Security scan results
utils/issues/issuescollection.go
Fix pull requests
- Auto-fix PR
autopr/autopr.go - Fix branch and commit
utils/git.go
Shared services
- Findings and reports
utils/outputwriter/outputcontent.go - GitLab report format
utils/gitlabreport/gitlabreport.go - PR comments
utils/comment.go - Git operations
utils/git.go
Other components
- Repository maintainer
- GitHub Actions
- JFrog security platform
- Git provider
Connections 24
- Repository maintainer → GitHub Actions: configures workflow
- GitHub Actions → Action event router: triggers event
- Action event router → Pull request scan: routes PR events
- Action event router → Repository scan: routes scheduled events
- Action event router → Auto-fix PR: routes auto-pr
- Repository maintainer → CLI command dispatch: runs CLI
- CLI command dispatch → Command definitions: loads commands
- Command definitions → Pull request scan: dispatches scan
- Command definitions → Repository scan: dispatches scan
- Pull request scan → JFrog security platform: requests security scans
- Repository scan → JFrog security platform: requests security scans
- Pull request scan → Security scan results: converts findings
- Repository scan → Security scan results: converts findings
- Pull request scan → PR comments: posts review comments
- Repository scan → Git operations: checks repository state
- Repository scan → Fix branch and commit: creates fix changes
- Repository scan → Git provider: creates fix PRs
- Auto-fix PR → Git operations: prepares repository
- Auto-fix PR → Fix branch and commit: updates dependencies
- Auto-fix PR → Git provider: creates fix PR
- Pull request scan → Git provider: reads PR data
- Security scan results → Findings and reports: formats findings
- Security scan results → GitLab report format: converts scan results
- Findings and reports → PR comments: supplies comment content