JFrog (Token) module

[bpmct]

A discussion dedicated to the JFrog (Token) module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
17 / 17	8 / 20	11 / 20	10 / 10	69 / 100

Drilldown

Presentation & Onboarding — 17 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README documents every major mode with dedicated examples: full install+configure (main example), token-only mode (install_jfrog_cli = false, configure_jfrog_cli = false), pre-installed binary mode (install_jfrog_cli = false with configure_jfrog_cli = true), per-package-manager configuration, code-server extension, custom token description, and reusing the token in other Terraform resources. Each example uses sensible defaults.
Visual preview	5	5	README embeds ; file verified to exist at 56.0 KB.

Credential Hygiene — 8 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	8	The output access_token is marked sensitive = true, and README examples reference var.artifactory_access_token rather than inlining literal keys. However, the primary input variable artifactory_access_token is not marked sensitive = true, and the coder_env resources (jfrog_ide_access_token, goproxy) that embed the scoped token in their values are also not marked sensitive. Half credit for partial coverage.
Non-hardcoded auth path	4	0	No documented alternative to supplying a raw admin access token. The README does not mention ServiceAccount, IAM/OAuth, an external secrets manager, Coder variable helpers, or any other mechanism to avoid pasting a key. The only auth path shown is artifactory_access_token = var.artifactory_access_token.

Restricted-Environment Readiness — 11 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	The JFrog CLI is installed via curl -fL https://install-cli.jfrog.io | sudo sh in run.sh. No module input variable overrides this download URL. There is no jfrog_cli_install_url, install_source, or equivalent variable.
Bring-your-own binary	10	10	install_jfrog_cli (default true) is documented in the README under "Token-only mode": "To configure a pre-installed jf binary, set only install_jfrog_cli = false and leave configure_jfrog_cli enabled. The module fails with a clear error if jf is required but unavailable." The script checks command -v jf and skips installation when the flag is false.
Egress transparency	3	0	No dedicated README section enumerates external endpoints (install-cli.jfrog.io, the user-supplied JFrog URL, open-vsx.org for the code-server extension, Artifactory API endpoints). Endpoints are only visible in source code and scattered examples.
Runs without sudo	2	1	run.sh invokes sudo sh and sudo chmod 755 /usr/local/bin/jf during CLI installation. However, this is gated behind install_jfrog_cli = true (the default). When set to false, the script performs no sudo calls and all configuration (npmrc, pip.conf, condarc, settings.xml, docker login, code-server extension) runs as the unprivileged user. Sudo is needed only for the optional install step with a working non-root fallback.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All 14 variables have clear descriptions. jfrog_url has a URL regex validation; username_field has an enum-style regex validation; package_managers has a cross-field validation ensuring npm and pnpm lists match. Sensible defaults throughout (check_license = true, install_jfrog_cli = true, configure_jfrog_cli = true, jfrog_server_id = "0"). The package_managers description includes a full example block.
Test coverage	4	4	.tftest.hcl (3 runs) covers business-logic branching: default creates the script, token-only mode omits it, package-manager-only mode creates it plus coder_env.goproxy. main.test.ts (9 tests) covers end-to-end script content for every package manager (npm, pnpm, shared npmrc, pip, docker, go, conda, maven), the missing-CLI error path, and required-variable validation. Tests spin up a local fake JFrog server via bun serve to avoid remote calls.

Overall — 69 / 100

Raw 46 / 67 → round(46 / 67 × 100) = 69

---

Scored against SCORECARD.md on 2026-10-26 with solstice-1.