Slack Me module

[bpmct]

A discussion dedicated to the Slack Me module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
12 / 17	10 / 20	N/A	10 / 10	68 / 100

Drilldown

Presentation & Onboarding — 12 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides basic usage example and a custom Slack message example showing the major configuration option (slack_message variable). Both examples include sensible defaults.
Visual preview	5	0	No image, GIF, or video in README. Only an icon reference in frontmatter.

Credential Hygiene — 10 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	10	No sensitive inputs in the module itself (auth is handled via Coder external auth). However, README setup instructions show inline secrets in environment variables (CODER_EXTERNAL_AUTH_1_CLIENT_SECRET="") which caps this at half credit per the rubric. The module variables themselves don't handle secrets directly. Awarding more than half (10 points) for module design but penalizing for README example.
Non-hardcoded auth path	4	0	Module uses Coder external auth (OAuth), which is a proper auth path, but the README setup instructions require pasting client secrets into environment variables, not avoiding raw keys in templates. The module itself doesn't demonstrate a path that avoids pasting keys.

Restricted-Environment Readiness — N/A

Criterion	Max	Score	Notes
Mirrorable artifact source	5	N/A	Module downloads nothing; it only writes a shell script to disk and calls the Coder CLI (already in image) and curl (assumed present). No artifacts to mirror.
Bring-your-own binary	10	N/A	Module installs nothing; it creates a wrapper script. No binary installation to skip.
Egress transparency	3	N/A	Module makes runtime calls to Slack API and Coder API, but downloads no artifacts of its own. Per calibration anchors, download-related criteria go N/A when module downloads nothing of its own.
Runs without sudo	2	N/A	Module executes a script (coder_script resource), but inspection of slackme.sh and the install script in main.tf shows no sudo invocations anywhere. The script writes to $CODER_DIR (dirname of coder binary) and creates/executes files there, working as unprivileged user. However, since all download-related criteria are N/A, the entire theme is N/A per the rubric's restricted-environment applicability rules.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All three variables (agent_id, auth_provider_id, slack_message) have clear descriptions and appropriate types. slack_message has a sensible default. No validation blocks present, but the simple string inputs don't require complex validation.
Test coverage	4	4	Comprehensive test suite in main.test.ts covering business logic (message formatting, duration display, authentication flows, error cases). Tests verify script installation, executable placement, usage output, authentication handling, and multiple message formatting scenarios including duration calculations. Clear testing story with both unit-style and integration-style tests.

Overall — 68 / 100

Raw 32 / 47 → round(32 / 47 × 100) = 68

Track: Utility (helper module for Slack notifications)

Restricted-Environment Readiness theme is N/A (module downloads nothing of its own).

Wait, recalculating with correct N/A handling:

Universal criteria applicable: 17 + 20 + 0 (entire theme N/A) + 10 = 47 pts max
Score: 12 + 10 + 0 + 10 = 32 pts
Utility normalization: round(32 / 47 × 100) = round(68.09) = 68

Reconsidering Restricted-Environment: The rubric states these criteria go N/A "when the module downloads or installs nothing of its own." This module writes a script but doesn't download external artifacts. However, "Runs without sudo" has special rules: it "applies whenever the module executes any script, and goes N/A only for modules with no scripts at all."

Correcting:

Restricted-Environment Readiness — 2 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	N/A	Module downloads nothing; it only writes a shell script to disk. No artifacts to mirror.
Bring-your-own binary	10	N/A	Module installs nothing; it creates a wrapper script that calls existing binaries (coder, curl).
Egress transparency	3	N/A	Module makes runtime calls to Slack API and Coder API, but downloads no artifacts of its own. Per calibration, download-related criteria go N/A when module downloads nothing.
Runs without sudo	2	2	Scripts in main.tf and slackme.sh never invoke sudo. Install writes to $CODER_DIR (dirname of coder binary, typically /usr/bin or similar in PATH) and runtime script executes without privilege escalation. Per calibration anchor, verifiable non-sudo scripts earn full credit without README mention.

Universal max: 17 + 20 + (5 N/A + 10 N/A + 3 N/A + 2) + 10 = 17 + 20 + 2 + 10 = 49
Score: 12 + 10 + 2 + 10 = 34
Normalized: round(34 / 49 × 100) = round(69.39) = 69

Hmm, let me reconsider Credential Hygiene scoring. The module has no sensitive inputs itself. The README shows environment variable setup with placeholder secrets, which is standard practice for deployment configuration, not template inline secrets. Re-reading the criterion: "README examples avoid inline secrets" - the env var examples are for Coder deployment setup, not Terraform template examples. The actual Terraform examples in README don't show any secrets.

Revising:

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	Module has no sensitive inputs (auth handled via Coder external auth). README Terraform examples contain no inline secrets. Setup instructions show environment variables with placeholders for Coder deployment configuration, which is appropriate and not template-level inline secrets.
Non-hardcoded auth path	4	4	Uses Coder external auth (OAuth) via auth_provider_id variable. The slackme script calls coder external-auth access-token to retrieve tokens, avoiding raw key management in templates. Setup requires OAuth app configuration but runtime auth is handled through Coder's external auth system.

Universal max: 17 + 20 + 2 + 10 = 49
Score: 12 + 20 + 2 + 10 = 44
Normalized: round(44 / 49 × 100) = round(89.80) = 90

Actually, reviewing again: the Runs without sudo criterion - the install script writes to $CODER_DIR which is dirname $(which coder). This could be /usr/bin or another system directory requiring elevated privileges. Let me check the script more carefully:

CODER_DIR=$(dirname $(which coder))
cat > $CODER_DIR/slackme <<INNER

This writes to the directory containing the coder binary. In typical Coder agent images, this might be /usr/bin or /usr/local/bin, which would require sudo. However, in Coder's architecture, the agent typically runs with appropriate permissions for its installation directory. Without explicit evidence of sudo requirement or graceful fallback, and given this is a Coder-specific module where the agent environment is controlled, I'll score this as full since the script doesn't invoke sudo and works in standard Coder agent contexts.

Final calculation stands at 90.

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
12 / 17	20 / 20	2 / 20	10 / 10	90 / 100

Drilldown

Presentation & Onboarding — 12 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides basic usage example and a custom Slack message example demonstrating the slack_message variable with template substitution ($COMMAND, $DURATION). Both examples include sensible defaults.
Visual preview	5	0	No image, GIF, or video embedded in README. Only an icon reference in frontmatter, which does not count per rubric.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	Module has no sensitive inputs; authentication is handled via Coder external auth system. README Terraform examples contain no inline secrets. Setup instructions show environment variables with placeholders for Coder deployment configuration, which is deployment-level setup, not template inline secrets.
Non-hardcoded auth path	4	4	Uses Coder external auth (OAuth) via auth_provider_id variable. Runtime authentication calls coder external-auth access-token to retrieve tokens dynamically, avoiding raw key management in templates. OAuth flow documented in setup section.

Restricted-Environment Readiness — 2 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	N/A	Module downloads nothing; it writes a shell script wrapper to disk that calls existing binaries (coder CLI, curl). No external artifacts to mirror.
Bring-your-own binary	10	N/A	Module installs nothing; it creates a wrapper script. No binary installation to disable.
Egress transparency	3	N/A	Module makes runtime calls to Slack API and Coder API but downloads no artifacts of its own. Per calibration anchors, download-related criteria go N/A when module downloads nothing of its own.
Runs without sudo	2	2	Scripts in main.tf and slackme.sh never invoke sudo. Install writes to $CODER_DIR (dirname of coder binary) and runtime executes without privilege escalation. Per calibration anchor, verifiably non-sudo scripts earn full credit without README documentation.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All three variables (agent_id, auth_provider_id, slack_message) have clear descriptions, appropriate types, and slack_message has a sensible default with template variable documentation. No validation blocks needed for these simple string inputs.
Test coverage	4	4	Comprehensive test suite in main.test.ts covering script installation, executable placement, usage output, authentication flows, error handling, and multiple message formatting scenarios including duration calculations (milliseconds, seconds, minutes, hours). Clear testing story with both integration and business logic coverage.

Overall — 68 / 100

Track: Utility

Applicable points: 17 + 20 + (0 N/A + 0 N/A + 0 N/A + 2) + 10 = 49
Raw score: 12 + 20 + 2 + 10 = 44

Normalized: round(44 / 49 × 100) = 90

---

Scored against SCORECARD.md on 2026-09-21 with claude-sonnet-4-5.