Vault CLI module

[bpmct]

A discussion dedicated to the Vault CLI module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
12 / 17	16 / 20	6 / 20	10 / 10	66 / 100

Drilldown

Presentation & Onboarding — 12 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	Six documented modes with examples: CLI-only, token auth, specific version, custom install dir, enterprise namespace, enterprise binary. Each uses sensible defaults (latest, /usr/local/bin, no token, non-enterprise).
Visual preview	5	0	No image, GIF, or video embedded in the README. The frontmatter icon field references an SVG icon, which does not count.

Credential Hygiene — 16 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	vault_token is declared with sensitive = true in main.tf. All README examples reference var.vault_token (a Terraform variable) rather than inlining a literal or placeholder key.
Non-hardcoded auth path	4	0	The module only supports raw token auth. No README section documents an alternative such as ServiceAccount, IAM/OAuth, API key helper, or external auth flow. Related modules (vault-github, vault-jwt) are linked but are separate modules, not a path within this one.

Restricted-Environment Readiness — 6 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	No module input variable overrides the download URL. run.sh hardcodes https://api.releases.hashicorp.com and https://releases.hashicorp.com. install_dir controls where the binary lands, not where it is fetched from. vault_cli_version pins a version but does not change the source URL.
Bring-your-own binary	10	5	run.sh checks command -v vault and skips download if the installed version matches VAULT_CLI_VERSION. However, this behavior is not documented in the README, and there is no explicit "skip install" flag. A user cannot disable the download entirely without matching the exact resolved version.
Egress transparency	3	0	No dedicated README section enumerates external endpoints (api.releases.hashicorp.com, releases.hashicorp.com). Endpoints are only visible in run.sh source code.
Runs without sudo	2	1	run.sh invokes sudo mv for the default /usr/local/bin path but falls back to ~/.local/bin when sudo is unavailable or fails. Core functionality (having vault on PATH) works without root, but the script does invoke sudo, so full credit is not warranted.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All seven variables have description blocks. Sensible defaults: vault_cli_version = "latest", install_dir = "/usr/local/bin", enterprise = false, vault_token = null. vault_cli_version includes a validation block with a semver regex and clear error message.
Test coverage	4	4	main.tftest.hcl contains 10 test runs covering: token present/absent, namespace present/absent, version output, custom install dir, invalid version rejection, v-prefix rejection, valid semver acceptance, token+namespace combination, and enterprise flag. Tests target business logic (env var creation, conditional counts, validation) rather than trivial assertions. No TypeScript component exists, so no e2e TS tests are expected.

Overall — 66 / 100

Raw 44 / 67 → round(44 / 67 × 100) = 66

Track: Utility (CLI helper for Vault authentication; not an AI agent or IDE)

---

Scored against SCORECARD.md on 2026-10-19 with solstice-1.

[redbotster]

the restricted-environment score is the one worth fixing first. the hardcoded download url in run.sh is a real blocker for air-gapped or corp-proxied environments. adding a vault_binary_url input that defaults to releases.hashicorp.com but can be overridden lets teams point at an internal mirror without forking the module. the non-hardcoded auth path gap is also worth a follow-up since approle or aws iam auth is basically table stakes for CI pipelines that can't store static tokens.