Scanning Commits and Pull Requests

This page covers the core Frogbot commands and concepts that apply regardless of which CI system you use.

Frogbot Commands

Scan Type	Command	Description
Pull Request	`frogbot scan-pull-request`	Scans a pull request by comparing the project state before and after the proposed change. Only new issues introduced by the PR are reported. Results are posted as PR comments (decorations).
Commit (Repository Scan)	`frogbot scan-repository`	Scans the latest commit of a branch for all existing vulnerabilities. When fixable issues are found and Auto-PR is enabled, Frogbot opens a pull request with the necessary dependency upgrades.

⚠️
Warning
The first Frogbot V3 scan of a Git repository switches that repository to V3 mode. You can't reverse this switch. That repository no longer receives new V2 scan results. If you still need V2 scanning, run V3 on a test repository first. For more information, see Frogbot V3.

Environment Variables

Required Variables

These variables must be set in your CI environment regardless of the CI system:

Variable	Description	Required
`JF_URL`	JFrog Platform URL (for example, `https://my-instance.jfrog.io`)	Yes
`JF_ACCESS_TOKEN`	JFrog Platform access token	Yes (or `JF_USER` + `JF_PASSWORD`)
`JF_USER` + `JF_PASSWORD`	JFrog username and password	Alternative to `JF_ACCESS_TOKEN`
`JF_GIT_TOKEN`	Git provider personal access token	Yes
`JF_GIT_API_ENDPOINT`	API endpoint for GitHub Enterprise	`https://api.github.com`
`JF_PROJECT_KEY`	JFrog project key for Xray policies	Yes, when using Projects in the JFrog platform.

To scan a named workspace in a monorepo, set JF_GIT_WORKSPACE to the workspace name. If you omit this variable, Frogbot uses the default workspace. For more information, see Manage Frogbot Workspaces.

For the full parameter reference, see Advanced Management and Configuration.

If the access token used by Frogbot is not an administrator, pre-create and index the Frogbot repository before the first scan. For more information, see Pre-create the Frogbot Repository.

Configuring Centralized Configuration

Instead of configuring Frogbot per-repository with environment variables and YAML files, Frogbot allows you to manage all settings using the JFrog Platform:

Configure scan settings in Administration > Xray Settings > Indexed Resources > Git Repositories.
Frogbot will fetch its configuration from the platform at scan time.

Platform-managed settings include: which scanners to enable, Auto-PR behavior, PR decoration options, and path exclusions. See Advanced Management and Configuration for details.

When both platform configuration and local settings (environment variables or frogbot-config.yml) are present, local settings take precedence.

Scan Behavior

Frogbot checks out the PR's target branch and scans it.
Frogbot checks out the PR's source branch and scans it.
The results are compared — only new issues are reported.
PR comments are posted with details about each new finding.

Default templates:

Setting	Default Value
Branch name	`frogbot-${IMPACTED_PACKAGE}-${BRANCH_NAME_HASH}`
Commit message	`Upgrade ${IMPACTED_PACKAGE} to ${FIX_VERSION}`
PR title	`[🐸 Frogbot] Upgrade ${IMPACTED_PACKAGE} to ${FIX_VERSION}`

The branch name template must include ${BRANCH_NAME_HASH} to ensure uniqueness.

Updated 8 days ago

Did this page help you?