Hashicorp Vault Integration (GitHub) module

[bpmct]

A discussion dedicated to the Hashicorp Vault Integration (GitHub) module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
17 / 25	20 / 20	7.5 / 20	8 / 10	70 / 100

Drilldown

Presentation & Onboarding — 17 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	Multiple examples cover different configuration modes: default setup, custom GitHub auth ID, custom auth path, and specific CLI version. Each has sensible defaults.
Coder-context framing	8	0	README does not explain what the module adds on top of Coder or show where Coder fits in the flow. It jumps directly to usage without framing the integration context.
Visual preview	5	5	README includes  showing the module in action.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No sensitive inputs are defined in the module. The module uses Coder external auth for GitHub, avoiding direct credential handling. README examples do not inline secrets.
Non-hardcoded auth path	4	4	Module uses Coder external auth (data.coder_external_auth.github) to obtain GitHub token, avoiding raw key pasting. This is documented in the README and examples.

Restricted-Environment Readiness — 7.5 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	0	The Vault CLI download URL is hardcoded to https://releases.hashicorp.com/vault/ in run.sh. No module variable allows overriding this URL to point to an internal mirror.
Bring-your-own binary	5	5	The install script checks if command -v vault and skips installation if the correct version is already present, allowing pre-baked images. This is verifiable in run.sh code.
Egress transparency	3	1.5	Endpoints are scattered across the code (releases.hashicorp.com in run.sh, vault_addr as user input) but no dedicated README section enumerates external endpoints for restricted environments.
Runs without sudo	2	1	run.sh attempts sudo mv vault /usr/local/bin/vault but falls back to ~/.local/bin/vault if sudo fails, with a note to add to PATH. This is a working fallback for the optional system-wide install.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. vault_cli_version has validation regex for version format. Sensible defaults provided (github, latest).
Test coverage	4	2	main.test.ts only tests required variables with testRequiredVariables. No .tftest.hcl file present. No end-to-end or business logic tests visible.

Overall — 70 / 100

Raw 52.5 / 75 → round(52.5 / 75 × 100) = 70

---

Scored against SCORECARD.md on 2026-08-03 with claude-sonnet-4-5.