Git Clone module

[bpmct]

A discussion dedicated to the Git Clone module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
17 / 25	20 / 20	N/A	10 / 10	85 / 100

Drilldown

Presentation & Onboarding — 17 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	Multiple documented examples covering major modes: custom path, Git authentication, GitHub/GitLab with branch names, self-hosted providers, branch_name attribute, folder_name override, extra_args, pre/post-clone scripts. Each has sensible defaults.
Coder-context framing	8	5	README states "This module allows you to automatically clone a repository" and shows Coder template usage, but does not explicitly name both Coder and Git or explain what the module adds on top of Coder's base functionality. The flow context is implicit rather than explicit.
Visual preview	5	0	No image, GIF, or video in README. Only an icon reference.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No sensitive inputs in this module (url, branch_name, folder_name are not secrets). README examples avoid inline secrets; Git Authentication example shows proper external auth pattern via data.coder_external_auth.
Non-hardcoded auth path	4	4	README documents Git Authentication via Coder's external auth (data.coder_external_auth.github), avoiding raw credential pasting.

Restricted-Environment Readiness — N/A

Criterion	Max	Score	Notes
Mirrorable artifact source	10	N/A	Module downloads nothing of its own; it only clones user-provided repository URLs. The url variable is the repository to clone, not a tool download source.
Bring-your-own binary	5	N/A	Module requires git but does not install it; assumes it exists in the image. No download/install to disable.
Egress transparency	3	N/A	Module contacts only the user-specified repository URL, not fixed external endpoints.
Runs without sudo	2	N/A	Scripts in run.sh and main.tf never invoke sudo; they run entirely as the user (mkdir, git clone, base64, etc.). Full credit from code inspection alone per rubric exception. However, this criterion is N/A because the module downloads nothing, making the entire Restricted-Environment theme N/A.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. Sensible defaults: base_dir defaults to empty (uses ~), branch_name empty (default branch), folder_name empty (derived from repo), extra_args empty list, pre/post_clone_script null. Validation on git_providers ensures only "github" or "gitlab" allowed.
Test coverage	4	4	.tftest.hcl covers business logic (script creation conditions, empty URL handling, folder_name reporting). main.test.ts provides comprehensive end-to-end tests: container execution, branch extraction, provider detection, pre/post-clone scripts, extra_args passing, SSH host key handling, log file creation. Clear testing story.

Overall — 85 / 100

Raw 47 / 55 → round(47 / 55 × 100) = 85

Utility module. Restricted-Environment Readiness is N/A (all four criteria excluded: module downloads nothing of its own, only operates on user-provided repository URLs).

---

Scored against SCORECARD.md on 2026-08-11 with claude-sonnet-4-5.