Hashicorp Vault Integration (GitHub) module

[bpmct]

A discussion dedicated to the Hashicorp Vault Integration (GitHub) module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
17 / 17	20 / 20	10 / 20	8 / 10	82 / 100

Drilldown

Presentation & Onboarding — 17 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides multiple documented examples covering different configuration modes: default setup, custom GitHub auth ID, custom auth path, and specific CLI version installation. Each has sensible defaults.
Visual preview	5	5	README includes vault-login.png image showing the module in action, verified to exist at 116.7 KB.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No sensitive inputs in the module itself. Authentication is handled via Coder external auth (GitHub token fetched via coder external-auth access-token), avoiding inline secrets entirely. README examples show no hardcoded credentials.
Non-hardcoded auth path	4	4	Module uses Coder's external auth mechanism for GitHub, avoiding raw API keys. The GitHub token is fetched programmatically via the Coder CLI, demonstrating a proper auth helper pattern.

Restricted-Environment Readiness — 10 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	The Vault CLI download URL is hardcoded to https://releases.hashicorp.com/vault/ in run.sh. No module variable exists to override this download source. The vault_cli_version variable only controls version selection, not the download URL itself.
Bring-your-own binary	10	10	The install script checks if vault is already installed with the correct version and skips installation if so: if command -v vault > /dev/null 2>&1; then CURRENT_VERSION=$(vault version...); if [ "$${CURRENT_VERSION}" = "$${INSTALL_VERSION}" ]; then ... installation_needed=0. This allows pre-baked images to skip download entirely.
Egress transparency	3	0	No dedicated README section enumerating external endpoints. The HashiCorp releases URL and user-provided vault_addr are inferable from code/examples but not documented in a network/air-gapped section.
Runs without sudo	2	0	The run.sh script attempts sudo mv vault /usr/local/bin/vault as the primary installation path. While it falls back to ~/.local/bin if sudo fails, the fallback requires manual PATH modification ("Please add ~/.local/bin to your PATH"), making it awkward rather than seamless. Core functionality requires either sudo or manual user intervention.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. Sensible defaults provided (coder_github_auth_id = "github", vault_github_auth_path = "github", vault_cli_version = "latest"). The vault_cli_version includes validation with regex pattern and error message.
Test coverage	4	2	TypeScript test in main.test.ts only covers Terraform init and required variables validation. No business logic tests (e.g., version parsing, auth flow) or end-to-end behavior tests visible. Coverage is minimal.

Overall — 82 / 100

Raw 55 / 67 → round(55 / 67 × 100) = 82 → 73 / 100

This is a Utility module (Vault integration/authentication helper). Raw score 55 / 75, normalized: round(55 / 75 × 100) = 73.

---

Scored against SCORECARD.md on 2026-09-14 with claude-sonnet-4-5.