Slack Me module

[bpmct]

A discussion dedicated to the Slack Me module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
13 / 25	20 / 20	N/A	10 / 10	78 / 100

Drilldown

Presentation & Onboarding — 13 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README shows basic usage and a custom message example with sensible defaults. Both major configuration modes (default message vs custom message) are documented.
Coder-context framing	8	1	README mentions Coder in the title and setup instructions reference "Coder deployment" and templates, but does not explain what the module adds on top of Coder or show where Coder fits in the developer flow. The value proposition (DM on command completion) is stated but not contextualized within Coder's workspace model.
Visual preview	5	0	No image, GIF, or video present. The icon reference points to an SVG but is not embedded in the README as a visual preview of the module in action.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No sensitive inputs in the module itself. The setup instructions reference CODER_EXTERNAL_AUTH_1_CLIENT_SECRET as an environment variable on the Coder deployment (not in the template), which is the appropriate pattern. No inline secrets in README examples.
Non-hardcoded auth path	4	4	Uses Coder's external auth provider mechanism (coder external-auth access-token) via auth_provider_id variable. This is OAuth-based and avoids raw API keys in templates.

Restricted-Environment Readiness — N/A

Criterion	Max	Score	Notes
Mirrorable artifact source	10	N/A	Module downloads nothing; it writes a shell script wrapper that calls existing coder and curl binaries.
Bring-your-own binary	5	N/A	Module downloads nothing; it writes a shell script wrapper that calls existing coder and curl binaries.
Egress transparency	3	N/A	Module downloads nothing; it writes a shell script wrapper that calls existing coder and curl binaries.
Runs without sudo	2	2	The install script writes to $CODER_DIR (derived from which coder) and uses chmod +x. No sudo invocation anywhere in main.tf or slackme.sh. Works as unprivileged user.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	Three inputs: agent_id (clear, required), auth_provider_id (clear, required), slack_message (clear description, sensible default with template variables documented). No validation needed for these string inputs.
Test coverage	4	4	Comprehensive TypeScript tests in main.test.ts cover end-to-end behavior: executable installation, usage output, authentication flow, message formatting with multiple duration formats, and custom message templates. Tests use container execution to verify actual runtime behavior.

Overall — 78 / 100

Raw 43 / 55 → round(43 / 55 × 100) = 78

---

Scored against SCORECARD.md on 2026-07-15 with claude-sonnet-4-5.