JFrog (Token) module

[bpmct]

A discussion dedicated to the JFrog (Token) module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
19 / 25	10 / 20	2 / 20	8 / 10	52 / 100

Drilldown

Presentation & Onboarding — 19 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	Multiple examples cover different package manager combinations (npm/go/pypi, local repos only, code-server integration, custom token description). Each shows sensible defaults.
Coder-context framing	8	7	README explains the module installs JF CLI and authenticates package managers with Artifactory using the Artifactory terraform provider. Names both Coder and JFrog/Artifactory. Shows Coder fits in the workspace provisioning flow. Slightly under-documented on how Coder specifically orchestrates this vs. manual setup.
Visual preview	5	0	README references  but the actual image file is not included in the module files provided. Icon reference exists but icons don't count per rubric.

Credential Hygiene — 10 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	10	The artifactory_access_token variable is NOT marked sensitive = true in main.tf. README examples show artifactory_access_token = var.artifactory_access_token which avoids inline secrets in examples, but the module input itself lacks the sensitive flag. The output access_token is marked sensitive. This is a significant gap—half credit capped by inline placeholder pattern and missing input sensitivity.
Non-hardcoded auth path	4	0	Module requires pasting an admin access token into the template. No OAuth, ServiceAccount, IAM, or API key helper path documented.

Restricted-Environment Readiness — 2 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	0	The JF CLI is downloaded from hardcoded https://install-cli.jfrog.io in run.sh. No module variable overrides this URL. The jfrog_url variable points to the user's Artifactory instance, not the CLI download source.
Bring-your-own binary	5	0	No documented way to skip JF CLI installation when it's pre-baked. The script checks if command -v jf and skips install if present, but this is not documented in README. Undocumented behavior scores 0.
Egress transparency	3	0	No dedicated README section enumerating external endpoints. Endpoints are scattered across examples (jfrog.io instances, install-cli.jfrog.io inferable from code). Per rubric, scattered mentions earn at most half, but there's no dedicated section at all, so 0.
Runs without sudo	2	2	The run.sh script uses sudo for JF CLI installation (`curl -fL https://install-cli.jfrog.io

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	Variables have clear descriptions. Sensible defaults for token_description, check_license, refreshable, expires_in, username_field, jfrog_server_id, configure_code_server. Validation on jfrog_url (HTTPS/HTTP regex) and username_field (email/username enum). package_managers has detailed description with example.
Test coverage	4	2	TypeScript tests in main.test.ts cover multiple package manager configurations (npm scoped repos, pip extra-indexes, docker, go, conda, maven) with assertions on generated config files and scripts. However, tests use a fake JFrog server and don't appear to test actual end-to-end behavior against real Artifactory. No .tftest.hcl file present. Per rubric, ".tftest.hcl primarily covers business logic, TypeScript tests cover end-to-end"—here only TypeScript tests exist and they mock the provider. Half credit.

Overall — 52 / 100

Raw 39 / 75 → round(39 / 75 × 100) = 52

This is a Utility module (configures package manager authentication, not an agent or IDE).

---

Scored against SCORECARD.md on 2026-08-17 with claude-sonnet-4-5.