Github Upload Public Key module

[bpmct]

A discussion dedicated to the Github Upload Public Key module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
13 / 25	20 / 20	N/A	10 / 10	78 / 100

Drilldown

Presentation & Onboarding — 13 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides clear examples for default usage and custom external auth ID. Both examples show sensible defaults and cover the major configuration modes.
Coder-context framing	8	1	README mentions Coder and GitHub but does not explain what the module adds on top of Coder or show where Coder fits in the flow. The description is minimal and lacks context about the automation benefit.
Visual preview	5	0	No image, GIF, or video present in README. Only an icon reference which does not count.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No sensitive inputs are exposed in the module interface. The module uses session tokens and external auth internally via data sources. README examples do not inline secrets.
Non-hardcoded auth path	4	4	Module uses Coder external auth integration with GitHub OAuth, avoiding raw API keys. README documents the external auth configuration path with scopes.

Restricted-Environment Readiness — N/A

Criterion	Max	Score	Notes
Mirrorable artifact source	10	N/A	Module downloads nothing; it only calls Coder and GitHub APIs using tools already in the image (curl, jq).
Bring-your-own binary	5	N/A	Module downloads nothing; it requires curl and jq to be pre-installed in the workspace image.
Egress transparency	3	N/A	Module downloads nothing; it only makes API calls to user-configured endpoints (Coder API and GitHub API).
Runs without sudo	2	2	Script run.sh never invokes sudo and runs entirely as unprivileged user. Full credit from code inspection.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. Defaults are sensible (external_auth_id defaults to "github", github_api_url to public GitHub API, key_name to null with documented fallback). No validation needed for these string inputs.
Test coverage	4	4	Comprehensive TypeScript test suite in main.test.ts covers business logic: creating new keys, custom key names, special characters in names, and detecting existing keys. Tests use mock server and container execution to verify end-to-end behavior.

Overall — 78 / 100

Raw 43 / 55 → round(43 / 55 × 100) = 78

---

Scored against SCORECARD.md on 2026-08-18 with claude-sonnet-4-5.