Github Upload Public Key module

[bpmct]

A discussion dedicated to the Github Upload Public Key module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
12 / 17	12 / 20	2 / 2	10 / 10	73 / 100

Drilldown

Presentation & Onboarding — 12 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README documents all three key_type modes (auth default, signing, both) with dedicated examples, plus a non-default external_auth_id example. Sensible defaults are stated for every variable.
Visual preview	5	0	No image, GIF, or video embedded in the README. The frontmatter icon field is a static SVG reference, not a visual preview of the module in action.

Credential Hygiene — 12 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	8	No module input is a secret (session token comes from data.coder_workspace_owner, GitHub token from coder external-auth access-token), so sensitive = true is vacuously satisfied. However, the README inlines a placeholder secret (CLIENT_SECRET=xxxxxxx) in the external-auth configuration example, which per calibration caps this at half.
Non-hardcoded auth path	4	4	The module uses Coder's built-in external auth (coder external-auth access-token $CODER_EXTERNAL_AUTH_ID) to obtain the GitHub token at runtime. No raw API keys are pasted into templates. Documented in the README Requirements section.

Restricted-Environment Readiness — 2 / 2 (18 pts N/A)

Criterion	Max	Score	Notes
Mirrorable artifact source	5	N/A	Module downloads and installs nothing. It invokes curl and jq already present in the image and calls the Coder/GitHub APIs. No artifact download URL to override.
Bring-your-own binary	10	N/A	No binary is downloaded or installed by the module. curl and jq are prerequisites expected in the image.
Egress transparency	3	N/A	Module downloads/installs nothing of its own; it only makes API calls to Coder and GitHub.
Runs without sudo	2	2	run.sh contains no sudo invocation. All operations (curl, jq, coder CLI) run as the unprivileged workspace user.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All five variables have clear description fields, sensible default values, and type constraints. key_type includes a validation block restricting values to auth, signing, or both.
Test coverage	4	4	main.tftest.hcl covers Terraform-level logic (key_type default, signing, both, invalid rejection). main.test.ts provides comprehensive end-to-end tests with a mock GitHub server: key creation, custom names, special characters, idempotency, pagination, signing/both modes, and skip-existing behavior.

Overall — 73 / 100

Raw 36 / 49 → round(36 / 49 × 100) = 73

Track: Utility (git helper module; not an AI agent or IDE)

(N/A exclusions: Mirrorable artifact source 5 + Bring-your-own binary 10 + Egress transparency 3 = 18 pts removed from the 67-pt universal denominator, yielding 49.)

---

Scored against SCORECARD.md on 2026-10-21 with solstice-1.