Hashicorp Vault Integration (GitHub) module

[bpmct]

A discussion dedicated to the Hashicorp Vault Integration (GitHub) module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
25 / 25	20 / 20	9 / 20	8 / 10	83 / 100

Drilldown

Presentation & Onboarding — 25 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	Multiple documented examples: default configuration, custom GitHub auth ID, custom auth path, specific CLI version. Each shows sensible defaults.
Coder-context framing	8	8	README clearly explains this integrates Hashicorp Vault with Coder workspaces using Coder's external auth for GitHub. Shows both tools and the flow.
Visual preview	5	5	README includes  showing the module in action.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No sensitive inputs in the module itself (uses external auth). README examples avoid inline secrets, using external auth flow instead.
Non-hardcoded auth path	4	4	Uses Coder external auth for GitHub (data.coder_external_auth.github) rather than requiring pasted tokens.

Restricted-Environment Readiness — 9 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	0	Hardcoded URL https://releases.hashicorp.com/vault/ in run.sh. No module variable overrides the download URL. vault_cli_version only controls version, not source.
Bring-your-own binary	5	5	Installation logic checks command -v vault and skips install if correct version already present. Documented in example showing version control.
Egress transparency	3	1.5	No dedicated section. Endpoints inferable from code (releases.hashicorp.com, Vault server at vault_addr) but not enumerated in README.
Runs without sudo	2	2	Script attempts sudo mv but falls back to ~/.local/bin when sudo fails, with user notification. Core functionality works without sudo.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions and sensible defaults. vault_cli_version includes validation regex for format.
Test coverage	4	2	TypeScript test only validates required variables (testRequiredVariables). No .tftest.hcl present. No business logic or end-to-end behavior testing.

Overall — 83 / 100

Raw 62 / 75 → round(62 / 75 × 100) = 83

---

Scored against SCORECARD.md on 2026-08-17 with claude-sonnet-4-5.