JFrog (Token) module

[bpmct]

A discussion dedicated to the JFrog (Token) module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
17 / 17	10 / 20	2 / 20	8 / 10	55 / 100

Drilldown

Presentation & Onboarding — 17 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides multiple documented examples covering major modes: full configuration with all package managers, token-only mode (no CLI install/config), pre-installed CLI mode, npm/go/pypi configuration, code-server integration, custom token description, and using the token output in other resources. Each has sensible defaults.
Visual preview	5	5	README includes  and the image exists (verified 56.0 KB).

Credential Hygiene — 10 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	8	The artifactory_access_token input variable is not marked sensitive = true in main.tf. The access_token output is marked sensitive. README examples show artifactory_access_token = var.artifactory_access_token which avoids inline literals, but the variable definition itself lacks the sensitive marker, and one example shows artifactory_access_token = "XXXX" as a placeholder inline secret. Half credit.
Non-hardcoded auth path	4	2	The module uses the Artifactory Terraform provider to generate scoped tokens, which is better than raw key pasting, but still requires an admin-level access token as input. This is a helper pattern rather than ServiceAccount/IAM/OAuth/external auth. Partial credit for the token-scoping mechanism.

Restricted-Environment Readiness — 2 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	The JFrog CLI is installed via `curl -fL https://install-cli.jfrog.io
Bring-your-own binary	10	0	The install_jfrog_cli = false variable disables installation, but the README does not document this as a bring-your-own-binary path. The token-only mode example mentions it but describes it as "another Terraform resource only needs the scoped access_token output" rather than documenting pre-installed CLI usage. The pre-installed CLI scenario is mentioned only in the context of configure_jfrog_cli behavior, not as a documented BYOB pattern.
Egress transparency	3	0	No dedicated README section enumerates external endpoints. Endpoints are scattered across examples (jfrog.io, artifactory API paths) but never consolidated. The README mentions "restricted or air-gapped environments" only in passing when describing token-only mode, without listing endpoints.
Runs without sudo	2	2	The run.sh script invokes sudo sh and sudo chmod only when installing the JFrog CLI (if [ "${INSTALL_CLI}" == "true" ]). When install_jfrog_cli = false, the script runs without sudo. All package manager configuration and other operations work as unprivileged user. This is an optional feature with a working fallback. Full credit.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	Inputs have clear descriptions. Validation on jfrog_url (must start with http/https) and username_field (must be email or username). Sensible defaults for token_description, check_license, refreshable, jfrog_server_id, configure_code_server, install_jfrog_cli, configure_jfrog_cli, and package_managers.
Test coverage	4	2	.tftest.hcl covers business logic (defaults preserve workspace config, token-only mode, package manager-only mode). TypeScript tests in main.test.ts cover end-to-end behavior (npmrc generation, pip config, docker registration, goproxy, conda, maven, error messages). However, the TypeScript tests use a fake JFrog server that returns dummy responses, limiting true end-to-end validation. Half credit for partial coverage.

Overall — 55 / 100

Raw 37 / 67 → round(37 / 67 × 100) = 55

Utility track (normalized from Universal criteria only)

---

Scored against SCORECARD.md on 2026-09-14 with claude-sonnet-4-5.