Hashicorp Vault Integration (GitHub) module

[bpmct]

A discussion dedicated to the Hashicorp Vault Integration (GitHub) module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
17 / 17	20 / 20	1 / 20	8 / 10	69 / 100

Drilldown

Track: Utility (auth/integration module; no AI agent or IDE functionality)

Presentation & Onboarding — 17 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README shows base usage plus three variant examples (custom coder_github_auth_id, custom vault_github_auth_path, pinned vault_cli_version), covering all exposed configuration knobs with sensible defaults.
Visual preview	5	5	../../.images/vault-login.png is embedded and verified to exist.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	Module takes no raw secret inputs; GitHub token is fetched at runtime via coder external-auth access-token, never typed into templates. README examples contain no inline keys/tokens.
Non-hardcoded auth path	4	4	Uses Coder's data.coder_external_auth.github (OAuth/external-auth) flow instead of pasting PATs/keys, documented in main README section.

Restricted-Environment Readiness — 1 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	run.sh hardcodes https://releases.hashicorp.com/vault/... for both version discovery and binary download; no module variable overrides this URL.
Bring-your-own binary	10	0	Script only skips reinstall if the already-installed version string exactly matches vault_cli_version; there is no documented variable/flag to disable install entirely when Vault is baked into the image.
Egress transparency	3	0	No dedicated network/air-gapped section; releases.hashicorp.com endpoint is only inferable from script source, not documented.
Runs without sudo	2	1	run.sh attempts sudo mv vault /usr/local/bin/vault 2>/dev/null but falls back to ~/.local/bin and instructs the user to update PATH if sudo is unavailable — working fallback for an optional step, earning half credit.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All variables have clear descriptions; required vars (agent_id, vault_addr) lack defaults appropriately, optional vars have sensible defaults, and vault_cli_version has a regex validation block.
Test coverage	4	2	main.test.ts only runs terraform init and testRequiredVariables; no business-logic or end-to-end TS tests, no .tftest.hcl files present.

Overall — 69 / 100

Raw 46 / 67 → round(46 / 67 × 100) = 69

---

Scored against SCORECARD.md on 2026-10-05 with solstice-1.