[matifali]

Description

Adds additional_args to git-clone and deprecates extra_args. The goal is one name for this input across the registry; the AGENTS.md rule is in coder/registry#1202.

additional_args is a list(string) with one element per argument. That's the same type as extra_args, so migrating is just a rename. Each element is passed to git clone exactly as written and in order, so a flag can repeat and a value can contain spaces.

module "git-clone" {
  count    = data.coder_workspace.me.start_count
  source   = "registry.coder.com/coder/git-clone/coder"
  version  = "2.1.0"
  agent_id = coder_agent.example.id
  url      = "https://github.com/coder/coder"
  additional_args = [
    "--depth", "1",
    "--recurse-submodules",
    "--jobs", "8",
    "--filter", "blob:none",
  ]
}

• Nothing breaks: extra_args still works exactly as before and is appended after additional_args. Its description and the README mark it deprecated.
• Validation: elements must be non-empty and must not contain newlines.
• Flags the module sets are rejected: -b and --branch, with or without =value, because the module already sets the branch from branch_name or the URL. A comment in main.tf and in run.sh says to keep this list in sync.
• Test fix: the test timeout is raised to 60s, because the first container tests pull the alpine and alpine/git images and outlasted bun's 5s default on a cold CI runner.

An earlier version of this PR used a map(string) of flag to value. Per review on coder/registry#1202, a map can't repeat a flag, and Terraform silently keeps only the last value of a repeated key. So the input is now a list.

Type of Change

• New module
• New template
• Bug fix
• Feature/enhancement
• Documentation
• Other

Module Information

Path: registry/coder/modules/git-clone
New version: v2.1.0
Breaking change: [ ] Yes [x] No — additional_args defaults to [] and extra_args is unchanged.

Testing & Validation

• Tests pass: terraform test, 7 passed. Covered: additional_args keeping order and a repeated -c with extra_args appended after; rejecting a newline; rejecting --branch=main.
• Container tests in main.test.ts cover additional_args (a repeated -c) followed by extra_args, and pass in CI.
• Code formatted (bun fmt); ./scripts/terraform_validate.sh passes

Related Issues

None

---

Generated by Claude Code

[github-actions]

Module Scorecard Check

coder/git-clone: 73 → 89

✅ Score improvement: 73 → 89 (+16).

Theme	Before	After
Presentation & Onboarding	12 / 17	12 / 17
Integration	—	—
Credential Hygiene	12 / 20	20 / 20
Restricted-Environment	2 / 2	2 / 2 (18 pts N/A)
Engineering Quality	10 / 10	10 / 10
Overall	73 / 100	89 / 100

Full scorecard for this PR

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
12 / 17	20 / 20	2 / 2 (18 pts N/A)	10 / 10	89 / 100

Drilldown

Track: Utility (git helper module; Universal criteria only, normalized per rubric)

Presentation & Onboarding — 12 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README documents distinct modes with sensible defaults: basic clone, custom base_dir, coder_external_auth integration, branch-via-URL, self-hosted GitHub/GitLab (git_providers), explicit branch_name, folder_name, additional_args, pre_clone_script/post_clone_script. Thorough coverage of major option combinations.
Visual preview	5	0	No image, GIF, or video anywhere in the README.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	Module has no secret-bearing inputs (no tokens/passwords/API keys); nothing needs sensitive = true. README examples never inline literal or placeholder secrets.
Non-hardcoded auth path	4	4	README's "Git Authentication" section documents using data.coder_external_auth (Coder's external auth provider) instead of pasting raw credentials.

Restricted-Environment Readiness — 2 / 2 (18 pts excluded as N/A)

Criterion	Max	Score	Notes
Mirrorable artifact source	5	N/A	Module installs/downloads nothing of its own — it only invokes git already expected on the image and clones a user-supplied URL (explicit example construction in rubric notes). Excluded from denominator.
Bring-your-own binary	10	N/A	No tool is bundled/installed by this module (script exits with "Git is not installed!" rather than installing it), so disable/skip-install is not an applicable concern. Excluded from denominator.
Egress transparency	3	N/A	No install/runtime download endpoints exist to enumerate beyond the user-provided repo URL and optional SSH host (ssh-keyscan), which are user-controlled, not module-controlled. Excluded from denominator.
Runs without sudo	2	2	run.sh and the generated coder_script never invoke sudo; all operations (mkdir, git clone, ssh-keyscan, known_hosts writes) run as the invoking user. Verified from script source — no root requirement for any path.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All variables have clear descriptions and sensible defaults (base_dir, branch_name, folder_name default empty; git_providers defaults to github/gitlab). Validations present for git_providers (allowed provider values) and additional_args (rejects newlines and -b/--branch conflicts).
Test coverage	4	4	.tftest.hcl covers business logic (URL parsing, branch extraction, empty/whitespace URL handling, additional_args validation failures). main.test.ts provides extensive e2e coverage in real containers: clone behavior, SSH known_hosts handling across URL formats, pre/post-clone script execution and failure propagation, extra_args/additional_args ordering via a fake-git shim, and logging output.

Overall — 89 / 100

Raw 42 / 47 → round(42 / 47 × 100) = 89

Tip

You can run this locally by telling your agent: "review this module against .github/scorecard/SCORECARD.md".

---

Scored against SCORECARD.md with solstice-1. Language-model scores are advisory.