Hashicorp Vault Integration (GitHub) module

[bpmct]

A discussion dedicated to the Hashicorp Vault Integration (GitHub) module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
11 / 17	20 / 20	1 / 20	8 / 10	60 / 100

Drilldown

Track: Utility (authentication/infra helper — no AI agent or IDE functionality)

Presentation & Onboarding — 11 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	6 (half)	README shows examples for coder_github_auth_id, vault_github_auth_path, and vault_cli_version, but the vault_namespace variable (Vault Enterprise namespace mount) has no accompanying example, leaving one configuration mode undemonstrated.
Visual preview	5	5 (full)	README embeds ../../.images/vault-login.png, confirmed to exist (116.7 KB).

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16 (full)	No secret-bearing variables exist in main.tf (GitHub token is fetched at runtime via coder external-auth access-token, never passed as a variable). README contains no inline keys or placeholder secrets.
Non-hardcoded auth path	4	4 (full)	Uses Coder's native GitHub external-auth integration (data.coder_external_auth.github) documented as the primary setup path — avoids pasting raw tokens.

Restricted-Environment Readiness — 1 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	run.sh hardcodes https://releases.hashicorp.com/vault/... for both the latest-version lookup and the binary download; vault_cli_version only pins a version string, not a URL. No variable overrides the download URL.
Bring-your-own binary	10	0	No documented variable to skip installation entirely. The script only skips re-download if an already-installed Vault binary happens to match the requested vault_cli_version — this is incidental behavior, not a documented disable-install option.
Egress transparency	3	0	No dedicated network/offline/air-gapped section in the README; external endpoints (releases.hashicorp.com, Coder API) are never enumerated.
Runs without sudo	2	1 (half)	run.sh attempts sudo mv vault /usr/local/bin/vault 2> /dev/null but falls back to ~/.local/bin and continues (with a PATH note) if sudo is unavailable — sudo used only for an optional system-wide install path with a working non-root fallback.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6 (full)	All variables have clear descriptions and sensible defaults (github auth path/id, latest CLI version, null namespace); vault_cli_version has a regex validation block.
Test coverage	4	2 (half)	main.test.ts only runs testRequiredVariables after terraform init — a minimal smoke test with no business-logic assertions (e.g., script content, env var resolution, conditional namespace behavior) and no .tftest.hcl.

Overall — 60 / 100

Raw 40 / 67 → round(40 / 67 × 100) = 60

---

Scored against SCORECARD.md on 2026-11-09 with solstice-1.