Git commit signing module

[bpmct]

A discussion dedicated to the Git commit signing module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
12 / 17	20 / 20	2 / 2	3 / 10	76 / 100

Drilldown

Track: Utility (git helper module; not an AI agent or IDE)

Presentation & Onboarding — 12 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	Module has a single input (agent_id) and one operational mode. The README provides a complete, copy-pasteable module block with count, source, version, and agent_id. No additional modes or provider choices exist to document.
Visual preview	5	0	No embedded image, GIF, or video in the README. The frontmatter references an SVG icon (icon: ../../../../.icons/git.svg), which does not count per calibration.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	The only Terraform variable is agent_id (a non-secret identifier). The SSH key is fetched at runtime via the Coder API using CODER_AGENT_TOKEN; no sensitive Terraform variables exist to mark. README example contains no inline secrets or placeholder keys.
Non-hardcoded auth path	4	4	run.sh authenticates to the Coder API using the built-in CODER_AGENT_TOKEN environment variable (set by Coder infrastructure). No raw keys are pasted into templates; the standard Coder agent-token pattern is used.

Restricted-Environment Readiness — 2 / 2 (18 pts N/A)

Criterion	Max	Score	Notes
Mirrorable artifact source	5	N/A	Module downloads no tool or binary. It only calls the Coder API (${CODER_AGENT_URL}api/v2/workspaceagents/me/gitsshkey) to fetch the SSH key. No download URL to mirror.
Bring-your-own binary	10	N/A	No tool is installed by the module. git, curl, and jq are expected pre-installed in the image; the script only checks for their presence and exits if missing.
Egress transparency	3	N/A	The module's sole external interaction is the Coder API call for the SSH key. No third-party endpoints are contacted.
Runs without sudo	2	2	run.sh never invokes sudo. All operations (mkdir, curl, jq, chmod, git config --global) target the user's home directory (~/.ssh/git-commit-signing/, ~/.gitconfig). Full credit from code inspection.

Engineering Quality — 3 / 10

Criterion	Max	Score	Notes
Input quality	6	3	agent_id has a type (string) and a clear description. No validation block is present (e.g., a non-empty-string check). No default is appropriate. Half credit for missing validation.
Test coverage	4	0	No .tftest.hcl, no TypeScript tests, and no testing story in the README. No test files are present in the module.

Overall — 76 / 100

Raw 37 / 49 → round(37 / 49 × 100) = 76

(Denominator: 67 universal pts − 18 N/A pts = 49. Badge: Strong)

---

Scored against SCORECARD.md on 2026-10-26 with solstice-1.