Hashicorp Vault Integration (GitHub) module

[bpmct]

A discussion dedicated to the Hashicorp Vault Integration (GitHub) module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
17 / 25	20 / 20	7.5 / 20	7 / 10	69 / 100

Drilldown

Presentation & Onboarding — 17 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	Multiple examples cover different configuration modes: default setup, custom GitHub auth ID, custom auth path, and specific CLI version. Each has sensible defaults.
Coder-context framing	8	0	README does not explain what the module adds on top of Coder or show where Coder fits in the flow. It jumps directly into usage without framing the integration context.
Visual preview	5	5	README includes  showing the module in action.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No sensitive inputs are defined in the module (it uses external auth). README examples avoid inline secrets, using external auth pattern throughout.
Non-hardcoded auth path	4	4	Module uses Coder external auth for GitHub (data.coder_external_auth.github), avoiding raw key pasting. The authentication flow retrieves tokens via coder external-auth access-token.

Restricted-Environment Readiness — 7.5 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	0	The Vault CLI download URL is hardcoded to https://releases.hashicorp.com/vault/ in run.sh. No module variable allows overriding this URL to point to an internal mirror.
Bring-your-own binary	5	5	The install script checks if command -v vault and skips installation if the correct version is already present, documenting the path to use pre-installed binaries.
Egress transparency	3	1.5	Endpoints are scattered across the script (releases.hashicorp.com) and examples (vault.example.com), but there is no dedicated README section enumerating external endpoints for restricted environments.
Runs without sudo	2	1	The run.sh script attempts sudo mv vault /usr/local/bin/vault but falls back to ~/.local/bin/vault if sudo fails, with a note to update PATH. This is a working fallback for the optional system-wide install, earning half credit.

Engineering Quality — 7 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions and sensible defaults. vault_cli_version includes validation regex for version format. Variables are well-documented.
Test coverage	4	1	main.test.ts only tests required variables with testRequiredVariables. No .tftest.hcl files present. No end-to-end or business logic tests beyond basic variable validation.

Overall — 69 / 100

Raw 51.5 / 75 → round(51.5 / 75 × 100) = 69

Track: Utility (authentication/integration module)

---

Scored against SCORECARD.md on 2026-08-10 with claude-sonnet-4-5.