Slack Me module

[bpmct]

A discussion dedicated to the Slack Me module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
13 / 25	10 / 20	N/A	8 / 10	56 / 100

Drilldown

Presentation & Onboarding — 13 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	6	Shows basic usage and one custom message example. Does not demonstrate multiple major modes or configuration variations beyond message customization.
Coder-context framing	8	7	Clearly explains this adds slackme command to workspaces, names both Coder and Slack, shows the flow (command → notification). Minor: could be slightly clearer about Coder's role in the auth flow.
Visual preview	5	0	No image, GIF, or video. Only references an icon file.

Credential Hygiene — 10 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	8	Module has no sensitive inputs itself (auth is via external-auth). README Setup section shows CODER_EXTERNAL_AUTH_1_CLIENT_SECRET in plaintext example, which is an inline secret in documentation. This caps the score at half.
Non-hardcoded auth path	4	2	Uses Coder external auth (coder external-auth access-token), which is OAuth-based and avoids pasting raw keys into templates. However, the Setup instructions still require pasting client secrets into environment variables, making the path only partially non-hardcoded.

Restricted-Environment Readiness — N/A

Criterion	Max	Score	Notes
Mirrorable artifact source	10	N/A	Module downloads nothing; it only writes a shell script that calls existing coder and curl binaries.
Bring-your-own binary	5	N/A	Module downloads nothing; it only writes a shell script.
Egress transparency	3	N/A	Module downloads nothing; runtime calls to Slack API are user-initiated via the command, not module installation.
Runs without sudo	2	N/A	Module executes a script but it only writes to $CODER_DIR (where coder binary exists, already writable) and never invokes sudo. However, since this theme is N/A due to no downloads, this criterion is also excluded.

Theme N/A: Module downloads/installs nothing of its own. All Restricted-Environment criteria excluded.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	Three inputs: agent_id (clear), auth_provider_id (clear), slack_message (clear description, sensible default). No validation blocks, but the inputs are simple strings where validation would add limited value.
Test coverage	4	2	TypeScript tests cover business logic well (message formatting, duration display, authentication flow). No .tftest.hcl files present for Terraform-level testing. Partial credit for good TS coverage but missing TF tests.

Overall — 56 / 100

Raw 31 / 55 → round(31 / 55 × 100) = 56

Track: Utility (helper module for Slack notifications, not an agent or IDE)

Normalization: Restricted-Environment Readiness (20 pts) marked N/A. Denominator: 75 - 20 = 55. Utility modules use denominator 75, but with N/A exclusions: 55. Final: round(31 / 55 × 100) = 56

---

Scored against SCORECARD.md on 2026-07-27 with claude-sonnet-4-5.