[35C4n0r]

Description

Adds an optional key_type variable to github-upload-public-key so the Coder public key can also be uploaded as a GitHub SSH signing key, letting GitHub verify commits signed with it.

• auth (default): uploads to /user/keys, same as before.
• signing: uploads to /user/ssh_signing_keys.
• both: uploads to both, checking each endpoint independently so an existing key on one does not skip the other.

Supersedes #1072 (thanks @v-atsai), keeping signing as an additive option instead of replacing authentication key upload.

Type of Change

• New module
• New template
• Bug fix
• Feature/enhancement
• Documentation
• Other

Module Information

Path: registry/coder/modules/github-upload-public-key
New version: v1.2.0
Breaking change: [ ] Yes [x] No

Testing & Validation

• Tests pass (bun test): 9/9, including new signing and both cases; terraform test: 4/4 (new main.tftest.hcl)
• Code formatted (bun fmt)
• Changes tested locally against real GitHub

Related Issues

Supersedes #1072

Decision log

• Additive, not a replacement. Per review on fix(github-upload-public-key): use ssh_signing_keys uri #1072, key_type defaults to auth so existing templates keep uploading an authentication key.
• Single upload_key function. Both endpoints share the same list/compare/POST flow, so run.sh runs it once per selected type and fails the script if either upload fails.
• Log wording. Messages now name the key type (for example, "added as a GitHub signing key"). This changes the wording on the default path too; no exit-code changes.
• Required permissions, checked against GitHub docs. Listing signing keys needs read:ssh_signing_key and creating needs write:ssh_signing_key; the README recommends admin:ssh_signing_key, matching the existing admin:public_key guidance. GitHub Apps need the "SSH signing keys" user permission (read for GET, write for POST).
• Out of scope. The module only uploads the key; configuring Git in the workspace to sign commits with it is left to the template.
• Version. Minor bump to 1.2.0 (new optional input).

---

Note

This PR was generated by Coder Agents on behalf of @35C4n0r, using Claude.

[github-actions]

Module Scorecard Check

coder/github-upload-public-key: 78 → 73

⚠️ Score regression: 78 → 73 (-5). Check the drilldown for which criteria dropped.

Theme	Before	After
Presentation & Onboarding	6 / 17	12 / 17
Integration	—	—
Credential Hygiene	20 / 20	12 / 20
Restricted-Environment	2 / 2	2 / 2
Engineering Quality	10 / 10	10 / 10
Overall	78 / 100	73 / 100

Full scorecard for this PR

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
12 / 17	12 / 20	2 / 2	10 / 10	73 / 100

Drilldown

Presentation & Onboarding — 12 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README documents all three key_type modes (auth default in first example, signing in prose "Set key_type to signing", both in second example), key_name in the first example, and external_auth_id in a dedicated example. Sensible defaults are stated for every variable.
Visual preview	5	0	No image, GIF, or video embedded in the README. The frontmatter icon field is a static SVG reference, not a visual preview of the module in action.

Credential Hygiene — 12 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	8	No module input is a secret (session token is obtained via data.coder_workspace_owner.me.session_token), so no sensitive = true is needed. However, the README's "Requirements" section inlines a placeholder secret: CODER_EXTERNAL_AUTH_0_CLIENT_SECRET=xxxxxxx, which triggers the calibration cap at half.
Non-hardcoded auth path	4	4	The module uses Coder External Auth (coder external-auth access-token) to obtain the GitHub token at runtime. No raw API keys or tokens are pasted into templates. The README explicitly documents the External Auth prerequisite and the required OAuth scopes.

Restricted-Environment Readiness — 2 / 2 (18 pts N/A)

Criterion	Max	Score	Notes
Mirrorable artifact source	5	N/A	The module downloads or installs nothing. It invokes curl and jq already present in the image and makes HTTP API calls to Coder and GitHub. No tool download URL exists to override.
Bring-your-own binary	10	N/A	No download or install step exists. The module requires curl and jq to be pre-installed (documented in README) but does not install them.
Egress transparency	3	N/A	The module downloads or installs nothing of its own; it only invokes pre-installed tools and calls APIs.
Runs without sudo	2	2	run.sh contains no sudo invocation. All operations (curl, jq, coder CLI) run as the unprivileged workspace user.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All five variables have clear description fields. key_type has a validation block restricting values to ["auth","signing","both"]. external_auth_id and github_api_url have sensible defaults. key_name defaults to null with a documented fallback.
Test coverage	4	4	main.tftest.hcl covers Terraform-level logic (key_type default, signing, both, invalid rejection via expect_failures). main.test.ts provides end-to-end tests executing the actual run.sh in a container against a mock GitHub API server, covering: new key creation, custom name, special characters, idempotency, signing-only, both, pagination, and skip-existing. Clear separation of concerns.

Overall — 73 / 100

Raw 36 / 49 → round(36 / 49 × 100) = 73

Track: Utility (helper module for GitHub key management; not an AI agent or IDE)

(N/A exclusions: Mirrorable artifact source 5, Bring-your-own binary 10, Egress transparency 3 = 18 pts removed from the 67-pt universal denominator, leaving 49.)

Tip

You can run this locally by telling your agent: "review this module against .github/scorecard/SCORECARD.md".

---

Scored against SCORECARD.md with solstice-1. Language-model scores are advisory.