You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Multiple documented examples cover major modes: basic usage, custom auth path, group-based role mapping, specific CLI version, custom display name, and custom JWT token generation. Each has sensible defaults.
Visual preview
5
0
No image, GIF, or video in README. Icon reference does not count.
Credential Hygiene — 18 / 20
Criterion
Max
Score
Notes
Secrets marked sensitive
16
16
vault_jwt_token variable is marked sensitive = true. README examples avoid inline secrets, using references like jwt_signed_token.vault[0].token or showing placeholder format "eyJhbGciOiJIUzI1N..." without actual keys.
Non-hardcoded auth path
4
2
Module uses OIDC token from Coder's authentication (data.coder_workspace_owner.me.oidc_access_token) as default, which is a form of OAuth/external auth. However, the README also shows custom JWT generation requiring manual key management (file("key.pem")), which is not a fully managed path. Earns half for partial non-hardcoded approach.
Restricted-Environment Readiness — 7.5 / 20
Criterion
Max
Score
Notes
Mirrorable artifact source
5
0
No module variable overrides the Vault CLI download URL (https://releases.hashicorp.com/vault/... is hardcoded in run.sh). The vault_cli_version variable only controls version selection, not the source URL.
Bring-your-own binary
10
5
The install script checks if vault is already installed with correct version and skips installation (installation_needed=0), but this is implicit behavior rather than a documented input variable to disable download. Earns half for working but under-documented capability.
Egress transparency
3
1.5
Endpoints are scattered across the script (releases.hashicorp.com for CLI download, user-provided vault_addr for Vault server) but no dedicated README section enumerates them or provides air-gapped guidance. Earns half per rubric.
Runs without sudo
2
1
Script attempts sudo mv vault /usr/local/bin/vault but falls back to ~/.local/bin/vault if sudo fails, with a note to add to PATH. This is a working fallback for optional system-wide install, earning half per rubric.
Engineering Quality — 7 / 10
Criterion
Max
Score
Notes
Input quality
6
5
Most inputs have clear descriptions and sensible defaults. vault_cli_version has validation regex. However, vault_jwt_token description could be clearer about when it's needed vs. defaulting to OIDC token. vault_addr lacks validation. Earns most but not full credit.
Test coverage
4
2
TypeScript test file exists (main.test.ts) and tests required variables, but coverage is minimal—only validates required inputs, no business logic or end-to-end behavior testing. Earns half.
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
A discussion dedicated to the Hashicorp Vault Integration (JWT) module. Share your thoughts, questions, and feedback here.
Module Scorecard
Drilldown
Presentation & Onboarding — 12 / 17
Credential Hygiene — 18 / 20
vault_jwt_tokenvariable is markedsensitive = true. README examples avoid inline secrets, using references likejwt_signed_token.vault[0].tokenor showing placeholder format"eyJhbGciOiJIUzI1N..."without actual keys.data.coder_workspace_owner.me.oidc_access_token) as default, which is a form of OAuth/external auth. However, the README also shows custom JWT generation requiring manual key management (file("key.pem")), which is not a fully managed path. Earns half for partial non-hardcoded approach.Restricted-Environment Readiness — 7.5 / 20
https://releases.hashicorp.com/vault/...is hardcoded in run.sh). Thevault_cli_versionvariable only controls version selection, not the source URL.installation_needed=0), but this is implicit behavior rather than a documented input variable to disable download. Earns half for working but under-documented capability.releases.hashicorp.comfor CLI download, user-providedvault_addrfor Vault server) but no dedicated README section enumerates them or provides air-gapped guidance. Earns half per rubric.sudo mv vault /usr/local/bin/vaultbut falls back to~/.local/bin/vaultif sudo fails, with a note to add to PATH. This is a working fallback for optional system-wide install, earning half per rubric.Engineering Quality — 7 / 10
vault_cli_versionhas validation regex. However,vault_jwt_tokendescription could be clearer about when it's needed vs. defaulting to OIDC token.vault_addrlacks validation. Earns most but not full credit.main.test.ts) and tests required variables, but coverage is minimal—only validates required inputs, no business logic or end-to-end behavior testing. Earns half.Overall — 66 / 100
Raw 44.5 / 67 → round(44.5 / 67 × 100) = 66
(Note: Recalculating: 12 + 18 + 7.5 + 7 = 44.5 out of 67 universal points. Normalized: 44.5 / 67 × 100 = 66.42 → 66)
Scored against SCORECARD.md on 2026-09-14 with
claude-sonnet-4-5.All reactions