XRAY: How to index and scan existing builds and artifacts

This article will provide guidance on how to scan and index pre-existing artifacts and builds and outline the anticipated behavior of Xray in such cases.

This article could be beneficial if you intend to connect an existing Artifactory instance to Xray or if you wish to expand the range of repositories and builds that require scanning.

Expected behavior of Xray when indexing resources

Xray will only scan artifacts in a repository or build that has already been added to the Indexed Resources. When a repository or build is added to the Indexed Resources, only future versions of artifacts or builds will be indexed and subsequently scanned by Xray.

Any existing artifacts or build versions that predate the addition of the repository/build to the Indexed Resources will not be indexed or scanned. Below are the steps to begin scanning pre-existing artifacts and build versions in an indexed repository or build.

Indexing existing artifacts

As previously stated, Xray will only index and scan newly added artifacts to an indexed repository. To index pre-existing artifacts you may use the option of ‘Index Now’ in the UI. 

Navigate to the admin tab → Xray → Settings → Indexed Resources. Select the "Index Now" option on the right-hand side, as depicted below:

Once "Index Now" is selected, additional options will be presented for selecting which artifacts in the repository should be indexed, as illustrated below:



After selecting the desired artifacts to index, they will be indexed and appear on the Scans List for scanning shortly thereafter.

You can watch a demo of these steps and access additional troubleshooting information concerning the indexing of pre-existing artifacts.

Scanning pre-existing builds

As previously mentioned, when existing builds are indexed in Indexed Resources, only future build versions will be scanned, not existing build versions. The following example shows Xray status as "Not Scanned" for pre-existing build versions.




To explicitly request a scan for a pre-existing build version, you can use the JFrog CLI command or Rest API.

For example, to scan an existing build version of "test-build" using JFrog CLI, you could use the following command:

jf bs test-build 3

In the UI, the Xray status will change to "Pending Scan," as shown below:




Once the build version has been scanned, you can view the details of the Xray scan by selecting the build ID.