Hashicorp Vault Integration (GitHub) module

[bpmct]

A discussion dedicated to the Hashicorp Vault Integration (GitHub) module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
17 / 17	20 / 20	6 / 20	8 / 10	76 / 100

Drilldown

Presentation & Onboarding — 17 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README documents four examples: default usage, custom coder_github_auth_id, custom vault_github_auth_path, and pinned vault_cli_version. All major configuration paths are covered with sensible defaults shown.
Visual preview	5	5	README embeds ; file verified to exist (116.7 KB).

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No Terraform variable carries a credential; the GitHub token and Vault token are obtained at runtime via coder external-auth access-token and vault login. No variable requires sensitive = true. README examples use only placeholder URLs (https://vault.example.com), no inline secrets.
Non-hardcoded auth path	4	4	Authentication flows through Coder's external-auth system (data "coder_external_auth" "github" + coder external-auth access-token). No raw keys are pasted into templates; the user configures GitHub auth in Coder's admin panel and references it by ID.

Restricted-Environment Readiness — 6 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	The download URL https://releases.hashicorp.com/vault/… is hardcoded in run.sh. No module input variable overrides this URL. vault_cli_version pins the version but does not change the source domain.
Bring-your-own binary	10	5	run.sh checks command -v vault and skips the download if the installed version matches INSTALL_VERSION. However, this behavior is not documented in the README, and the user must pin the exact version to trigger the skip. Implemented but under-documented → half.
Egress transparency	3	0	No dedicated README section enumerates external endpoints (releases.hashicorp.com, the user-supplied Vault server, Coder API). Endpoints are only visible in source code.
Runs without sudo	2	1	run.sh invokes sudo mv vault /usr/local/bin/vault as the primary install path, with a graceful fallback to ~/.local/bin when sudo is unavailable. Sudo is used for the preferred (but optional) system install location with a working non-root fallback → half.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All six variables have clear description fields. Sensible defaults provided (github, latest, null). vault_cli_version includes a validation block with a regex enforcing 0.0.0 or latest format.
Test coverage	4	2	main.test.ts runs terraform init and calls testRequiredVariables to confirm agent_id and vault_addr are detected. No .tftest.hcl file exists. No business-logic tests (version validation, namespace handling, script rendering). Minimal smoke test only → half.

Overall — 76 / 100

Raw 51 / 67 → round(51 / 67 × 100) = 76

---

Scored against SCORECARD.md on 2026-10-19 with solstice-1.