Github Upload Public Key module

[bpmct]

A discussion dedicated to the Github Upload Public Key module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
12 / 17	20 / 20	2 / 2	10 / 10	90 / 100

Drilldown

Presentation & Onboarding — 12 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README documents all major modes: key_type (auth, signing, both) with dedicated examples, external_auth_id with a non-default-ID example, and key_name with a usage example. Sensible defaults are stated for each.
Visual preview	5	0	No image, GIF, or video embedded in the README. The frontmatter icon field references an SVG icon, which does not count.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No module input is a secret; the session token is obtained via data.coder_workspace_owner.me.session_token (Coder-managed). README examples contain no inline secrets in module usage. The CODER_EXTERNAL_AUTH_0_CLIENT_SECRET=xxxxxxx line documents Coder deployment prerequisites, not a module input.
Non-hardcoded auth path	4	4	The module uses coder external-auth access-token to obtain a GitHub token at runtime. README explicitly documents the GitHub External Auth prerequisite and the required scopes, providing a clear path that avoids pasting raw API keys into templates.

Restricted-Environment Readiness — 2 / 2 (18 pts N/A)

Criterion	Max	Score	Notes
Mirrorable artifact source	5	N/A	Module downloads and installs nothing of its own. It invokes curl, jq, and the coder CLI already present in the image. No download URL to override.
Bring-your-own binary	10	N/A	Module does not download or install any tool. curl and jq are prerequisites the user must pre-install; there is no install step to skip.
Egress transparency	3	N/A	Module downloads nothing of its own. It only calls the Coder API and the GitHub API at runtime.
Runs without sudo	2	2	run.sh never invokes sudo. All operations (curl, jq, coder CLI) run as the unprivileged workspace user.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All five variables have clear description fields, sensible defaults (external_auth_id = "github", github_api_url = "https://api.github.com", key_type = "auth", key_name = null), and key_type includes a validation block restricting values to auth/signing/both.
Test coverage	4	4	main.tftest.hcl covers business logic (key_type default, signing, both, invalid rejection). main.test.ts provides end-to-end tests executing the actual run.sh in a container against a mock GitHub API server, covering: new key creation, custom/special-character key names, idempotency, signing-only, both, pagination, and skip-existing.

Overall — 90 / 100

Raw 44 / 49 → round(44 / 49 × 100) = 90

---

Scored against SCORECARD.md on 2026-10-26 with solstice-1.