Hashicorp Vault Integration (GitHub) module

[bpmct]

A discussion dedicated to the Hashicorp Vault Integration (GitHub) module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
25 / 25	20 / 20	10 / 20	8 / 10	84 / 100

Drilldown

Presentation & Onboarding — 25 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	Multiple documented examples: default configuration, custom GitHub auth ID, custom auth path, and specific CLI version. Each example is complete and sensible.
Coder-context framing	8	8	README clearly explains this integrates Hashicorp Vault with Coder workspaces using Coder's external auth for GitHub. Shows both Vault CLI and API usage patterns within the workspace context.
Visual preview	5	5	README includes  showing the module in action.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No sensitive inputs are exposed in the module interface. Authentication flows through Coder's external auth system (data.coder_external_auth.github), avoiding direct credential handling. README examples show no inline secrets.
Non-hardcoded auth path	4	4	Uses Coder's external auth system for GitHub OAuth, avoiding raw API keys entirely. The coder external-auth access-token command in run.sh retrieves tokens through Coder's managed auth flow.

Restricted-Environment Readiness — 10 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	0	The download URL https://releases.hashicorp.com/vault/${INSTALL_VERSION}/vault_${INSTALL_VERSION}_linux_${ARCH}.zip is hardcoded in run.sh. No module variable allows overriding this URL to point to an internal mirror.
Bring-your-own binary	5	5	The install function in run.sh checks if command -v vault and skips installation if the correct version is already present: "Vault version X is already installed and up-to-date." This is documented in the example showing vault_cli_version configuration.
Egress transparency	3	1.5	External endpoints are visible in code (releases.hashicorp.com for Vault download, $VAULT_ADDR for runtime) but no dedicated README section enumerates them or provides air-gapped guidance. Scattered across implementation only earns half per rubric.
Runs without sudo	2	2	The run.sh script attempts sudo mv vault /usr/local/bin/vault but has a working fallback: on failure it uses mkdir -p ~/.local/bin and mv vault ~/.local/bin/vault, printing a PATH instruction. Core functionality works without sudo.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. Sensible defaults provided (coder_github_auth_id = "github", vault_github_auth_path = "github", vault_cli_version = "latest"). Validation present on vault_cli_version with regex pattern for version format.
Test coverage	4	2	TypeScript test in main.test.ts covers required variables (agent_id, vault_addr) and runs terraform init. No .tftest.hcl file present for business logic testing. Limited end-to-end coverage.

Overall — 84 / 100

Raw 63 / 75 → round(63 / 75 × 100) = 84

---

Scored against SCORECARD.md on 2026-07-15 with claude-sonnet-4-5.