JFrog (OAuth) module

[bpmct]

A discussion dedicated to the JFrog (OAuth) module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
17 / 17	20 / 20	14 / 20	10 / 10	91 / 100

Drilldown

Presentation & Onboarding — 17 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README documents multiple major modes: full package-manager example, pnpm-only, pip, code-server, access-token-only, and username handling.
Visual preview	5	5	README embeds ../../.images/jfrog-oauth.png (verified exists, 47.9 KB).

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No secret inputs; access_token output is marked sensitive = true. README examples use placeholders (XXXXXXXXXXXXXXXXXXX), no inline secrets.
Non-hardcoded auth path	4	4	README shows Coder external-auth OAuth flow with CODER_EXTERNAL_AUTH_* config, avoiding raw keys in templates.

Restricted-Environment Readiness — 14 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	No input variable overrides the JFrog CLI download URL. run.sh hardcodes https://install-cli.jfrog.io. Pre-install path is BYOB, not mirrorable.
Bring-your-own binary	10	10	install_jfrog_cli = false documented in "Offline and air-gapped environments" and access-token-only mode.
Egress transparency	3	3	Dedicated "External endpoints" subsection lists https://install-cli.jfrog.io and jfrog_url.
Runs without sudo	2	1	run.sh invokes sudo for CLI install (`curl

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	Variables have descriptions, defaults, and validation (jfrog_url regex, username_field enum, package_managers npm/pnpm match).
Test coverage	4	4	Comprehensive .tftest.hcl covers package managers, validation failures, access-token-only, code-server env.

Overall — 91 / 100

Raw 61 / 67 → round(61 / 67 × 100) = 91

---

Scored against SCORECARD.md on 2026-11-09 with solstice-1.