Git Clone module

[bpmct]

A discussion dedicated to the Git Clone module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
17 / 25	20 / 20	N/A	10 / 10	85 / 100

Drilldown

Presentation & Onboarding — 17 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	Multiple documented examples cover major modes: custom path, Git authentication, GitHub/GitLab with branches, self-hosted providers, custom folder names, extra args, pre/post-clone scripts. Each has sensible defaults.
Coder-context framing	8	5	README explains what the module does (clone a Git repository) and shows Coder integration via coder_agent, but does not explicitly name "Coder" in the description or explain where Coder fits in the developer flow. The context is implicit rather than explicit.
Visual preview	5	0	No image, GIF, or video in the README. Only an icon reference.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No sensitive inputs exist in this module. The url variable accepts repository URLs which are not secrets. README examples show Git Authentication via coder_external_auth data source (non-hardcoded path), avoiding inline secrets entirely.
Non-hardcoded auth path	4	4	README explicitly documents using Coder's Git Authentication feature via data.coder_external_auth to avoid pasting credentials. This is a proper OAuth/external auth integration path.

Restricted-Environment Readiness — N/A

Criterion	Max	Score	Notes
Mirrorable artifact source	10	N/A	Module downloads nothing of its own; it only invokes git clone on user-provided URLs. The repository URL is user-controlled input, not a module-managed artifact download.
Bring-your-own binary	5	N/A	Module requires git to be present but does not install it. No download/install mechanism exists to disable.
Egress transparency	3	N/A	Module contacts only the user-specified repository URL, not module-controlled endpoints.
Runs without sudo	2	N/A	Scripts in main.tf and run.sh never invoke sudo and run entirely as the unprivileged user. All operations (mkdir, git clone, base64, tee) work without elevated privileges.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. Defaults are sensible (empty strings for optional paths, empty list for extra_args, null for scripts). The git_providers variable includes validation ensuring only "github" or "gitlab" values.
Test coverage	4	4	Comprehensive .test.ts file with 20+ test cases covering business logic (URL parsing, branch extraction, provider detection, folder naming) and end-to-end behavior (script execution, pre/post-clone hooks, extra_args handling, SSH key management, error conditions). Tests verify both Terraform outputs and actual script execution in containers.

Overall — 85 / 100

Raw 47 / 55 → round(47 / 55 × 100) = 85

Track: Utility (git helper module, not an agent or IDE)

Final Score: 85 / 100 (Strong)

---

Scored against SCORECARD.md on 2026-07-15 with claude-sonnet-4-5.