Hashicorp Vault Integration (GitHub) module

[bpmct]

A discussion dedicated to the Hashicorp Vault Integration (GitHub) module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
17 / 17	20 / 20	10 / 20	8 / 10	82 / 100

Drilldown

Presentation & Onboarding — 17 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides multiple documented examples covering different configuration modes: default setup, custom GitHub auth ID, custom auth path, and specific CLI version installation. Each has sensible defaults.
Visual preview	5	5	README includes  which exists and displays the module in action (116.7 KB).

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No sensitive inputs are defined in the module itself. The module uses Coder's external auth mechanism (coder_external_auth.github) which handles credentials outside the template. README examples show no inline secrets.
Non-hardcoded auth path	4	4	Module uses Coder's external auth for GitHub (data.coder_external_auth.github), avoiding raw API keys. The authentication flow retrieves tokens via coder external-auth access-token command, demonstrating a proper OAuth/external auth pattern.

Restricted-Environment Readiness — 10 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	The download URL https://releases.hashicorp.com/vault/${INSTALL_VERSION}/vault_${INSTALL_VERSION}_linux_${ARCH}.zip is hardcoded in run.sh. No module variable allows overriding this URL to point to an internal mirror.
Bring-your-own binary	10	10	The install script checks if command -v vault and skips installation if the correct version is already present: "Vault version ${CURRENT_VERSION} is already installed and up-to-date." This allows pre-baking vault into images.
Egress transparency	3	0	No dedicated README section enumerates external endpoints. Endpoints are inferable from code (releases.hashicorp.com, the user-provided vault_addr) but not documented in a network/air-gapped/restricted environment section.
Runs without sudo	2	0	The run.sh script attempts sudo mv vault /usr/local/bin/vault for core installation. While it falls back to ~/.local/bin on failure, the fallback requires manual PATH modification ("Please add ~/.local/bin to your PATH"), making it awkward rather than seamless. The sudo attempt for core functionality scores 0.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. Sensible defaults provided (coder_github_auth_id = "github", vault_github_auth_path = "github", vault_cli_version = "latest"). The vault_cli_version includes validation: `can(regex("^(latest
Test coverage	4	2	TypeScript test exists (main.test.ts) covering required variables with testRequiredVariables. However, no .tftest.hcl file present for Terraform-native business logic testing. Test coverage is partial.

Overall — 82 / 100

Raw 55 / 67 → round(55 / 67 × 100) = 82 → 73 / 100

This is a Utility module (Vault authentication integration). Raw score 55 / 75, normalized: round(55 / 75 × 100) = 73.

---

Scored against SCORECARD.md on 2026-09-21 with claude-sonnet-4-5.