JFrog (OAuth) module

[bpmct]

A discussion dedicated to the JFrog (OAuth) module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
21.5 / 25	18 / 20	2.5 / 20	10 / 10	69 / 100

Drilldown

Presentation & Onboarding — 21.5 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	Multiple documented examples covering different package managers (npm, go, pypi, docker, conda, maven), code-server integration, and using the access token in other terraform resources. Each example shows sensible defaults and clear configuration patterns.
Coder-context framing	8	4	README mentions Coder's external-auth feature and links to Coder documentation for setup. However, it does not clearly explain what the module adds on top of Coder or show where Coder fits in the overall flow. The framing focuses more on JFrog than on the Coder integration story.
Visual preview	5	5	README includes an image: 

Credential Hygiene — 18 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	The access_token output is marked sensitive = true. README examples avoid inline secrets, using external-auth flow instead. No hardcoded credentials in examples.
Non-hardcoded auth path	4	2	Uses OAuth via Coder external-auth, which is a proper auth flow. However, the README shows the access token being used directly in templates (e.g., in docker provider example with password = try(module.jfrog[0].access_token, "")), which while not hardcoded, still involves pasting tokens into templates. Partial credit for OAuth flow but imperfect implementation guidance.

Restricted-Environment Readiness — 2.5 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	0	The JFrog CLI is downloaded from a hardcoded URL https://install-cli.jfrog.io in run.sh with no module variable to override it. No input variable exists to point to an internal mirror.
Bring-your-own binary	5	0	No documented way to skip the JFrog CLI installation when it's already in the image. The script checks if command -v jf but still runs the install script with sudo if not found; there's no variable to disable installation entirely.
Egress transparency	3	1.5	External endpoints are scattered across examples (jfrog.io URLs, install-cli.jfrog.io) but there is no dedicated README section enumerating all external endpoints contacted at install and runtime. The Prerequisites section mentions "self-hosted (on-premises)" but doesn't enumerate egress requirements. Partial credit for some endpoint visibility in examples.
Runs without sudo	2	1	The run.sh script uses sudo for JFrog CLI installation: `curl -fL https://install-cli.jfrog.io

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. Sensible defaults provided (username_field = "username", external_auth_id = "jfrog", configure_code_server = false). Validation blocks present for jfrog_url (URL format) and username_field (enum). package_managers uses optional() with empty list defaults.
Test coverage	4	4	Comprehensive .tftest.hcl file with 12 test runs covering: required vars, empty/valid access tokens, URL validation, username_field validation, and each package manager (npm, go, pypi, docker, conda, maven). Tests verify script content, environment variables, and configuration. Clear testing story with business logic coverage.

Overall — 69 / 100

Raw 52 / 75 → round(52 / 75 × 100) = 69

Grade: Adequate

---

Scored against SCORECARD.md on 2026-08-03 with claude-sonnet-4-5.