JFrog (Token) module

[bpmct]

A discussion dedicated to the JFrog (Token) module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
17 / 17	8 / 20	11 / 20	10 / 10	69 / 100

Drilldown

Track: Utility (JFrog/Artifactory credential + package-manager configuration helper — not an IDE or agent tool)

Presentation & Onboarding — 17 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README documents multiple major modes with working examples: full install+configure, token-only mode (install_jfrog_cli=false/configure_jfrog_cli=false), pre-installed jf binary mode, package-manager configs (npm/pnpm/go/pypi/conda/maven), code-server extension mode, custom token description, and raw token output reuse in another provider.
Visual preview	5	5	README embeds , verified to exist (56KB).

Credential Hygiene — 8 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	8	README examples reference var.artifactory_access_token rather than inline literal keys (good). However, the primary secret input variable "artifactory_access_token" in main.tf is not marked sensitive = true (only the output access_token is). Partial pass → half.
Non-hardcoded auth path	4	0	No ServiceAccount/OAuth/IAM/API-key-helper alternative documented; the module requires a raw admin-level artifactory_access_token as the sole auth mechanism, with no alternate flow shown.

Restricted-Environment Readiness — 11 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	run.sh hardcodes curl -fL https://install-cli.jfrog.io | sudo sh. No module variable overrides this install URL for an internal mirror.
Bring-your-own binary	10	10	Documented: setting install_jfrog_cli = false (with configure_jfrog_cli = true) uses a pre-installed jf binary, and the script fails with a clear error if jf is required but missing — a working, documented skip-install path.
Egress transparency	3	0	No dedicated README section enumerating external endpoints (install-cli.jfrog.io, Artifactory host, etc.) for restricted/air-gapped environments.
Runs without sudo	2	1	Install path uses sudo sh and sudo chmod for the default install_jfrog_cli=true flow (core functionality requires root), but the documented install_jfrog_cli=false BYOB path runs without sudo — optional-feature sudo with working fallback = half.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	Clear descriptions and sensible defaults throughout; validations present for jfrog_url (URL scheme), username_field (enum), and package_managers (npm/pnpm consistency check).
Test coverage	4	4	.tftest.hcl covers business logic (default config, token-only mode, package-manager-only mode) and main.test.ts provides thorough end-to-end coverage (npm/pnpm shared .npmrc, pip, go, docker, conda, maven rendering, and missing-CLI error path) against a mocked JFrog server.

Overall — 69 / 100

Raw 46 / 67 → round(46 / 67 × 100) = 69

---

Scored against SCORECARD.md on 2026-11-09 with solstice-1.