Hashicorp Vault Integration (GitHub) module

[bpmct]

A discussion dedicated to the Hashicorp Vault Integration (GitHub) module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
17 / 17	20 / 20	10 / 20	8 / 10	82 / 100

Drilldown

Presentation & Onboarding — 17 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides multiple documented examples covering different configuration modes: default setup, custom GitHub auth ID, custom auth path, and specific CLI version installation. Each has sensible defaults.
Visual preview	5	5	README includes vault-login.png image showing the module in action, verified to exist at ../../.images/vault-login.png (116.7 KB).

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	Module uses Coder external auth for GitHub tokens; no sensitive inputs are defined in the module itself. README examples avoid inline secrets entirely, relying on external auth flow.
Non-hardcoded auth path	4	4	README demonstrates authentication via Coder external auth (coder_github_auth_id) which avoids pasting raw keys. The module fetches tokens programmatically via coder external-auth access-token.

Restricted-Environment Readiness — 10 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	No module input variable overrides the Vault CLI download URL. The script hardcodes https://releases.hashicorp.com/vault/ with no override mechanism.
Bring-your-own binary	10	10	The install script checks if command -v vault and skips installation if the correct version is already present, allowing pre-baked binaries. Documented in the version-specific example showing vault_cli_version control.
Egress transparency	3	0	No dedicated README section enumerates external endpoints. Endpoints are inferable from code (releases.hashicorp.com, user-provided vault_addr) but not documented in a network/air-gapped section.
Runs without sudo	2	0	run.sh attempts sudo mv vault /usr/local/bin/vault for core installation, falling back to ~/.local/bin only on sudo failure. Sudo is required for the primary installation path, not just optional features.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions and sensible defaults. vault_cli_version includes validation regex `^(latest
Test coverage	4	2	main.test.ts exists and tests required variables (agent_id, vault_addr) with runTerraformInit. However, coverage is minimal—only validates required inputs, no business logic or end-to-end behavior testing of auth flow, version handling, or namespace configuration.

Overall — 82 / 100

Raw 55 / 67 → round(55 / 67 × 100) = 82

---

Scored against SCORECARD.md on 2026-08-31 with claude-sonnet-4-5.