JFrog (Token) module

[bpmct]

A discussion dedicated to the JFrog (Token) module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
19 / 25	10 / 20	2 / 20	8 / 10	52 / 100

Drilldown

Presentation & Onboarding — 19 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	Multiple examples cover different package manager combinations (npm/go/pypi, local repos only, code-server integration, custom token description). Each shows sensible defaults.
Coder-context framing	8	7	README explains the module installs JF CLI and authenticates package managers with Artifactory using the Artifactory terraform provider. Names both Coder and JFrog/Artifactory. Shows Coder fits in the workspace provisioning flow. Slightly under-documented on how Coder specifically orchestrates this vs. manual setup.
Visual preview	5	0	README references  but the actual image file is not included in the module files provided. Icon reference exists but icons don't count per rubric.

Credential Hygiene — 10 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	10	The artifactory_access_token variable is NOT marked sensitive = true in main.tf. README examples show artifactory_access_token = var.artifactory_access_token which avoids inline secrets in examples, but the module input itself lacks the sensitive flag. The output access_token is marked sensitive. This is a significant gap—half credit capped by inline placeholder pattern and missing input sensitivity.
Non-hardcoded auth path	4	0	Module requires pasting an admin access token into the template. No OAuth, ServiceAccount, IAM, or external auth alternative documented.

Restricted-Environment Readiness — 2 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	0	The JF CLI is downloaded from hardcoded https://install-cli.jfrog.io in run.sh with no module variable to override this URL. No download URL override variable exists.
Bring-your-own binary	5	0	No documented way to skip JF CLI installation when it's pre-baked. The script checks if command -v jf and skips installation if present, but this is not documented in README as a supported pattern for restricted environments.
Egress transparency	3	0	No dedicated README section enumerating external endpoints. Endpoints are scattered across code (install-cli.jfrog.io, user's jfrog_url) but not consolidated in a network/air-gap section.
Runs without sudo	2	2	The run.sh script uses sudo for JF CLI installation (curl -fL https://install-cli.jfrog.io | sudo sh and sudo chmod 755 /usr/local/bin/jf), but gracefully skips installation if jf is already present. The rest of the script (authentication, package manager config) runs without sudo. This is a working fallback for the optional install feature—earns full credit per rubric.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	Variables have clear descriptions. jfrog_url has validation for http/https. username_field has validation for email/username. package_managers has detailed description with examples. Sensible defaults where applicable (token_description, check_license, refreshable, jfrog_server_id).
Test coverage	4	2	TypeScript tests in main.test.ts cover business logic for npm scoped repos, pip extra-indexes, docker registration, go proxy, conda, and maven config generation. Tests use a fake JFrog server. No .tftest.hcl file present for Terraform-native testing. Half credit for partial coverage.

Overall — 52 / 100

Raw 39 / 75 → round(39 / 75 × 100) = 52

Track: Utility (configures package managers and artifact authentication, not an agent or IDE)

---

Scored against SCORECARD.md on 2026-07-27 with claude-sonnet-4-5.