Github Upload Public Key module

[bpmct]

A discussion dedicated to the Github Upload Public Key module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
12 / 17	20 / 20	2 / 2 (18 pts N/A)	10 / 10	89 / 100

Drilldown

Track: Utility (git/auth helper module — scored on Universal criteria only, normalized to 100)

Presentation & Onboarding — 12 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README documents the default (auth key) mode, a key_type = "both" mode with commit-signing requirements explained, and a custom external_auth_id example. The module's small surface area (5 vars) is well covered with sensible defaults shown in each snippet.
Visual preview	5	0	No image, GIF, or video anywhere in the README.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No user-supplied secret inputs exist (GitHub token is fetched at runtime via coder external-auth access-token; session token comes from data.coder_workspace_owner.me.session_token, not a variable). README examples contain no inline literal or placeholder keys.
Non-hardcoded auth path	4	4	Uses GitHub External Auth (OAuth) exclusively, with a fully documented scopes/config walkthrough (CODER_EXTERNAL_AUTH_0_SCOPES=...), avoiding any pasted PAT/API key.

Restricted-Environment Readiness — 2 / 2 (18 pts N/A)

Criterion	Max	Score	Notes
Mirrorable artifact source	5	N/A	Module downloads/installs no tool of its own — it only calls the GitHub API and Coder API using curl/jq assumed present in the image. github_api_url overrides the API endpoint, not a download URL for an installed binary.
Bring-your-own binary	10	N/A	No binary is installed by this module, so there is nothing to disable/replace.
Egress transparency	3	N/A	No install-time or tool-download egress exists by construction; only runtime API calls to Coder and GitHub, which is outside this criterion's intended scope (no artifact to fetch).
Runs without sudo	2	2	run.sh never invokes sudo; uses only curl, jq, and coder external-auth as the invoking user. Verified directly in script.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All variables (agent_id, external_auth_id, github_api_url, key_name, key_type) have clear descriptions and sensible defaults; key_type has an explicit validation block restricting to auth/signing/both.
Test coverage	4	4	main.tftest.hcl covers key_type defaults and validation failure (business logic); main.test.ts has thorough Bun/TypeScript e2e tests covering new-key creation, existing-key detection, pagination, special characters, and all key_type modes.

Overall — 89 / 100

Raw 42 / 47 → round(42 / 47 × 100) = 89

---

Scored against SCORECARD.md on 2026-11-09 with solstice-1.