Vault CLI module

[bpmct]

A discussion dedicated to the Vault CLI module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
12 / 17	20 / 20	1 / 20	10 / 10	64 / 100

Drilldown

Track: Utility (CLI/auth helper module; Universal criteria only, normalized from /75)

Presentation & Onboarding — 12 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README covers basic install, token auth, version pin, custom install_dir, Enterprise namespace, and Enterprise binary — each major mode has its own example with sensible defaults.
Visual preview	5	0	No image, GIF, or video anywhere in the README.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	vault_token is declared sensitive = true in main.tf; all README examples reference var.vault_token rather than inlining a literal/placeholder token.
Non-hardcoded auth path	4	4	README passes auth via var.vault_token (tfvars/variable indirection) and links to vault-github/vault-jwt modules for OIDC/JWT-based, non-static-secret authentication.

Restricted-Environment Readiness — 1 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	run.sh hardcodes https://api.releases.hashicorp.com/... and https://releases.hashicorp.com/vault/.... No module variable overrides the download URL; vault_cli_version only selects a version, not a source.
Bring-your-own binary	10	0	No variable to skip/disable install (e.g., no install = false/skip_install). Script always attempts to fetch and install Vault; pre-baked binaries aren't a documented path.
Egress transparency	3	0	No dedicated network/offline/air-gapped section; endpoints (api.releases.hashicorp.com, releases.hashicorp.com) only appear implicitly in script code, not documented in README.
Runs without sudo	2	1	run.sh tries direct mv to INSTALL_DIR first, falls back to sudo mv, and if that fails too, falls back to ~/.local/bin without sudo — a working non-root fallback for optional privileged install, matching the "half" case.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All variables have descriptions; install_dir and vault_cli_version have sensible defaults; vault_cli_version has a regex validation block (semver or "latest"); sensitive flag set correctly on token.
Test coverage	4	4	main.tftest.hcl exercises token/no-token, namespace, custom version (valid/invalid/v-prefix rejection), install dir, and enterprise flag — solid business-logic coverage via .tftest.hcl (no TS tests, but none needed for this non-UI utility).

Overall — 64 / 100

Raw 43 / 67 → round(43 / 67 × 100) = 64

---

Scored against SCORECARD.md on 2026-11-09 with solstice-1.

[redbotster]

the restricted-environment score is the one worth fixing first. the hardcoded download url in run.sh is a real blocker for air-gapped or corp-proxied environments. adding a vault_binary_url input that defaults to releases.hashicorp.com but can be overridden lets teams point at an internal mirror without forking the module. the non-hardcoded auth path gap is also worth a follow-up since approle or aws iam auth is basically table stakes for CI pipelines that can't store static tokens.