Github Upload Public Key module

[bpmct]

A discussion dedicated to the Github Upload Public Key module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
13 / 25	20 / 20	N/A	10 / 10	78 / 100

Drilldown

Presentation & Onboarding — 13 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	Two clear examples: basic usage and custom external auth ID. Both show sensible defaults and different configuration modes.
Coder-context framing	8	1	Opening sentence mentions "Templates that utilize Github External Auth" and "Coder public key," but does not explain what the module adds on top of Coder or show where Coder fits in the flow. Lacks clear framing of the automation benefit.
Visual preview	5	0	No image, GIF, or video. Only an icon reference.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No sensitive inputs in the module itself. The session token is handled internally via data source. README examples avoid inline secrets entirely.
Non-hardcoded auth path	4	4	Uses Coder External Auth (OAuth flow) and workspace owner session token from data sources. No raw keys required.

Restricted-Environment Readiness — N/A

Criterion	Max	Score	Notes
Mirrorable artifact source	10	N/A	Module downloads nothing; it only calls Coder API and GitHub API using curl/jq already in the image.
Bring-your-own binary	5	N/A	Module downloads nothing; requires curl and jq pre-installed.
Egress transparency	3	N/A	Module downloads nothing; it only makes API calls to user-configured endpoints.
Runs without sudo	2	N/A	No scripts execute installation commands; run.sh is a pure bash script with API calls that never invokes sudo.

Note: All Restricted-Environment criteria are N/A because the module downloads/installs nothing. It only invokes pre-existing tools (curl, jq) to call APIs.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	Three inputs with clear descriptions and sensible defaults. agent_id required, external_auth_id defaults to "github", github_api_url defaults to public GitHub API. No validation blocks needed for these simple string inputs.
Test coverage	4	4	Comprehensive TypeScript tests in main.test.ts covering key scenarios: creating new key, detecting existing key, with mock server. Tests verify both success paths and business logic.

Overall — 78 / 100

Raw 43 / 55 → round(43 / 55 × 100) = 78 → 76 / 100

Raw score: 43 / 55 (after N/A exclusions: 25 + 20 + 10 = 55)
Normalized: round(43 / 55 × 100) = round(78.18) = 78

Correction: Raw 43 / 55 → round(43 / 55 × 100) = 78 / 100

---

Scored against SCORECARD.md on 2026-08-11 with claude-sonnet-4-5.