# jfrog/frogbot architecture

> Architecture diagram of the GitHub repository jfrog/frogbot, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-29). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/jfrog/frogbot
- Repository: https://github.com/jfrog/frogbot

## Overview

Frogbot is a Git security bot with two main workflows: assess proposed pull-request changes and periodically scan repositories to open remediation pull requests. Its documented scans cover dependency vulnerabilities and license compliance, contextual analysis, SAST, secrets, and IaC. The graph includes the GitHub Action entry point, CLI dispatch, scan and fix workflows, and shared reporting/Git layers. Some command wiring and scanner internals were not sampled, so uncertain connections are omitted.

Main entry points: [`scanrepository/scanrepository.go`](https://github.com/jfrog/frogbot/blob/main/scanrepository/scanrepository.go) (Repository scan), [`scanpullrequest/scanpullrequest.go`](https://github.com/jfrog/frogbot/blob/main/scanpullrequest/scanpullrequest.go) (Pull request scan), [`action/src/main.ts`](https://github.com/jfrog/frogbot/blob/main/action/src/main.ts) (Action event router), [`autopr/autopr.go`](https://github.com/jfrog/frogbot/blob/main/autopr/autopr.go) (Auto-fix PR)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_entry["Entry points"]
  node_action["Action event router<br/>[main.ts]"]
  node_cli["CLI command dispatch<br/>[main.go]"]
  node_commands["Command definitions<br/>[commands.go]"]
end

subgraph group_scanning["Security scanning"]
  node_prscan["Pull request scan<br/>[scanpullrequest.go]"]
  node_reposcan["Repository scan<br/>[scanrepository.go]"]
  node_scanresults["Security scan results"]
end

subgraph group_remediation["Fix pull requests"]
  node_auto["Auto-fix PR<br/>[autopr.go]"]
  node_gitfix["Fix branch and commit<br/>[git.go]"]
end

subgraph group_shared["Shared services"]
  node_output["Findings and reports<br/>[outputcontent.go]"]
  node_gitlabreport["GitLab report format<br/>[gitlabreport.go]"]
  node_comments["PR comments<br/>[comment.go]"]
  node_git["Git operations<br/>[git.go]"]
end

node_developer(("Repository maintainer"))
node_github(("GitHub Actions"))
node_jfrog{{"JFrog security platform"}}
node_vcs{{"Git provider"}}

node_developer -->|"configures workflow"| node_github
node_github -->|"triggers event"| node_action
node_action -->|"routes PR events"| node_prscan
node_action -->|"routes scheduled events"| node_reposcan
node_action -->|"routes auto-pr"| node_auto
node_developer -->|"runs CLI"| node_cli
node_cli -->|"loads commands"| node_commands
node_commands -->|"dispatches scan"| node_prscan
node_commands -->|"dispatches scan"| node_reposcan
node_prscan -->|"requests security scans"| node_jfrog
node_reposcan -->|"requests security scans"| node_jfrog
node_prscan -->|"converts findings"| node_scanresults
node_reposcan -->|"converts findings"| node_scanresults
node_prscan -->|"posts review comments"| node_comments
node_reposcan -->|"checks repository state"| node_git
node_reposcan -->|"creates fix changes"| node_gitfix
node_reposcan -->|"creates fix PRs"| node_vcs
node_auto -->|"prepares repository"| node_git
node_auto -->|"updates dependencies"| node_gitfix
node_auto -->|"creates fix PR"| node_vcs
node_prscan -->|"reads PR data"| node_vcs
node_scanresults -->|"formats findings"| node_output
node_scanresults -.->|"converts scan results"| node_gitlabreport
node_output -->|"supplies comment content"| node_comments

click node_action "https://github.com/jfrog/frogbot/blob/main/action/src/main.ts"
click node_cli "https://github.com/jfrog/frogbot/blob/main/main.go"
click node_commands "https://github.com/jfrog/frogbot/blob/main/commands.go"
click node_prscan "https://github.com/jfrog/frogbot/blob/main/scanpullrequest/scanpullrequest.go"
click node_reposcan "https://github.com/jfrog/frogbot/blob/main/scanrepository/scanrepository.go"
click node_scanresults "https://github.com/jfrog/frogbot/blob/main/utils/issues/issuescollection.go"
click node_output "https://github.com/jfrog/frogbot/blob/main/utils/outputwriter/outputcontent.go"
click node_gitlabreport "https://github.com/jfrog/frogbot/blob/main/utils/gitlabreport/gitlabreport.go"
click node_comments "https://github.com/jfrog/frogbot/blob/main/utils/comment.go"
click node_git "https://github.com/jfrog/frogbot/blob/main/utils/git.go"
click node_auto "https://github.com/jfrog/frogbot/blob/main/autopr/autopr.go"
click node_gitfix "https://github.com/jfrog/frogbot/blob/main/utils/git.go"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_action,node_cli,node_commands toneBlue
class node_prscan,node_reposcan,node_scanresults toneAmber
class node_auto,node_gitfix toneMint
class node_output,node_gitlabreport,node_comments,node_git toneRose
class node_developer,node_github,node_jfrog,node_vcs toneIndigo
```

## Components

### Entry points

- [Action event router](https://github.com/jfrog/frogbot/blob/main/action/src/main.ts): `action/src/main.ts`
- [CLI command dispatch](https://github.com/jfrog/frogbot/blob/main/main.go): `main.go`
- [Command definitions](https://github.com/jfrog/frogbot/blob/main/commands.go): `commands.go`

### Security scanning

- [Pull request scan](https://github.com/jfrog/frogbot/blob/main/scanpullrequest/scanpullrequest.go): `scanpullrequest/scanpullrequest.go`
- [Repository scan](https://github.com/jfrog/frogbot/blob/main/scanrepository/scanrepository.go): `scanrepository/scanrepository.go`
- [Security scan results](https://github.com/jfrog/frogbot/blob/main/utils/issues/issuescollection.go): `utils/issues/issuescollection.go`

### Fix pull requests

- [Auto-fix PR](https://github.com/jfrog/frogbot/blob/main/autopr/autopr.go): `autopr/autopr.go`
- [Fix branch and commit](https://github.com/jfrog/frogbot/blob/main/utils/git.go): `utils/git.go`

### Shared services

- [Findings and reports](https://github.com/jfrog/frogbot/blob/main/utils/outputwriter/outputcontent.go): `utils/outputwriter/outputcontent.go`
- [GitLab report format](https://github.com/jfrog/frogbot/blob/main/utils/gitlabreport/gitlabreport.go): `utils/gitlabreport/gitlabreport.go`
- [PR comments](https://github.com/jfrog/frogbot/blob/main/utils/comment.go): `utils/comment.go`
- [Git operations](https://github.com/jfrog/frogbot/blob/main/utils/git.go): `utils/git.go`

### Other components

- **Repository maintainer**
- **GitHub Actions**
- **JFrog security platform**
- **Git provider**

## Connections

- Repository maintainer → GitHub Actions: configures workflow
- GitHub Actions → Action event router: triggers event
- Action event router → Pull request scan: routes PR events
- Action event router → Repository scan: routes scheduled events
- Action event router → Auto-fix PR: routes auto-pr
- Repository maintainer → CLI command dispatch: runs CLI
- CLI command dispatch → Command definitions: loads commands
- Command definitions → Pull request scan: dispatches scan
- Command definitions → Repository scan: dispatches scan
- Pull request scan → JFrog security platform: requests security scans
- Repository scan → JFrog security platform: requests security scans
- Pull request scan → Security scan results: converts findings
- Repository scan → Security scan results: converts findings
- Pull request scan → PR comments: posts review comments
- Repository scan → Git operations: checks repository state
- Repository scan → Fix branch and commit: creates fix changes
- Repository scan → Git provider: creates fix PRs
- Auto-fix PR → Git operations: prepares repository
- Auto-fix PR → Fix branch and commit: updates dependencies
- Auto-fix PR → Git provider: creates fix PR
- Pull request scan → Git provider: reads PR data
- Security scan results → Findings and reports: formats findings
- Security scan results → GitLab report format: converts scan results
- Findings and reports → PR comments: supplies comment content