Dotfiles module

[bpmct]

A discussion dedicated to the Dotfiles module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
6 / 17	20 / 20	1 / 2	10 / 10	76 / 100

Drilldown

Presentation & Onboarding — 6 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	6	README documents major modes: current user vs root, SSH vs HTTPS URLs, and default_dotfiles_uri. However, manual_update (refresh button) and post_clone_script are significant options with no README example. Half credit for partial coverage of major configuration modes.
Visual preview	5	0	No image, GIF, or video embedded in the README. The frontmatter icon field references an SVG but that is not a visual preview of the module in action.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No sensitive inputs exist in this module. The dotfiles_uri is a repository URL (auth handled by the workspace agent), not a secret. README examples use placeholder URLs (https://github.com/coder/dotfiles) with no inline keys or tokens.
Non-hardcoded auth path	4	4	README "SSH vs HTTPS URLs" section explicitly documents that SSH URLs "authenticate with the workspace's SSH key instead of a token-based HTTPS flow." The coder dotfiles command leverages the Coder agent's existing credentials—no raw key pasting required.

Restricted-Environment Readiness — 1 / 2

Criterion	Max	Score	Notes
Mirrorable artifact source	5	N/A	Module does not download or install any tool. It invokes the pre-existing coder CLI to clone a user-specified git repository. No download URL to override.
Bring-your-own binary	10	N/A	Module does not download or install any binary. The coder CLI is assumed to be present in the agent image.
Egress transparency	3	N/A	Module does not download or install anything of its own. Its only external interaction is cloning a user-provided repository URL via the Coder CLI.
Runs without sudo	2	1	run.sh invokes sudo -u "$DOTFILES_USER" when applying dotfiles to a non-current user. This is an optional feature (the default path applies to the current user without sudo). README documents: "only works if sudo is passwordless." Working non-root fallback exists → half.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All 12 variables have clear description fields. Sensible defaults throughout (null, "", false). Validation blocks on dotfiles_uri, default_dotfiles_uri (regex for valid repo URLs), dotfiles_branch (non-empty check), and user (username regex).
Test coverage	4	4	main.test.ts provides a clear testing story: URL format validation (6 valid formats), security/injection rejection (6 malicious inputs), parameter creation and ordering, branch handling, fish-shell compatibility, and coder_app command verification. Tests exercise both business logic and end-to-end Terraform apply behavior.

Overall — 76 / 100

Raw 37 / 49 → round(37 / 49 × 100) = 76

Track: Utility (helper module for dotfiles; not an AI agent or IDE). Restricted-Environment download criteria (18 pts) excluded as N/A per calibration anchors—module operates on user-provided URLs only and installs nothing.

---

Scored against SCORECARD.md on 2026-10-26 with solstice-1.