JFrog (OAuth) module

[bpmct]

A discussion dedicated to the JFrog (OAuth) module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
17 / 25	20 / 20	17.5 / 20	10 / 10	86 / 100

Drilldown

Presentation & Onboarding — 17 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides multiple documented examples covering major modes: basic OAuth setup, npm configuration with scoped packages, code-server integration, using access token in other resources, and individual package manager configurations (pip, go, docker, conda, maven). Each example includes sensible defaults and clear context.
Coder-context framing	8	5	README explains what the module adds (JFrog CLI installation and package manager authentication via OAuth), names both Coder and JFrog/Artifactory, and shows Coder's external-auth role. However, the flow description is scattered across Prerequisites and Setup sections rather than a cohesive "how Coder fits" narrative. The connection between Coder external-auth and workspace token injection could be clearer.
Visual preview	5	0	README references an image path  but the actual image file is not included in the provided module files. Icon references exist but icons are not previews of the module in action.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	The access_token output is marked sensitive = true in main.tf. README examples avoid inline secrets entirely—all examples use OAuth flow via external-auth, with no hardcoded API keys or passwords. The templates (.tftpl files) reference variables that are populated from the OAuth token at runtime.
Non-hardcoded auth path	4	4	README documents OAuth as the primary authentication mechanism via Coder's external-auth feature. Users authenticate through an OAuth flow and receive user-scoped access tokens. No raw keys are pasted into templates. The Prerequisites and Setup sections provide complete OAuth configuration instructions.

Restricted-Environment Readiness — 17.5 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	0	The module downloads JFrog CLI from https://install-cli.jfrog.io (hardcoded in run.sh line 28). There is no module input variable to override this download URL. The jfrog_url variable points to the Artifactory instance for API operations, not the CLI download source.
Bring-your-own binary	5	5	README "Offline and air-gapped environments" section explicitly documents: "If jf is already on the PATH (for example, baked into your workspace image), the module detects it and skips the download." The run.sh script (lines 21-26) implements this check with command -v jf.
Egress transparency	3	3	README includes a dedicated "External endpoints" section that enumerates the actual endpoints contacted: https://install-cli.jfrog.io (only when JFrog CLI not installed) and the user's jfrog_url (for package manager configuration and OAuth token exchange). Includes notes for restricted environments.
Runs without sudo	2	0	The run.sh script requires sudo for core functionality. Lines 28-29: `curl -fL https://install-cli.jfrog.io

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. jfrog_url has validation for HTTPS/HTTP format. username_field has validation restricting to "email" or "username". package_managers has detailed description with examples. Sensible defaults provided: username_field = "username", external_auth_id = "jfrog", configure_code_server = false, jfrog_server_id = "0", and optional package manager lists default to empty.
Test coverage	4	4	Clear testing story with jfrog-oauth.tftest.hcl covering business logic: required variables, empty/valid access token handling, URL validation, username_field validation, and package manager configurations (npm, go, pypi, docker, conda, maven). Tests verify script content, environment variables, and resource creation. Tests use override_data to mock external auth. No TypeScript tests visible, but .tftest.hcl provides comprehensive Terraform-level coverage.

Overall — 86 / 100

Raw 64.5 / 75 → round(64.5 / 75 × 100) = 86

Track: Utility (authentication/integration helper module)

---

Scored against SCORECARD.md on 2026-08-17 with claude-sonnet-4-5.