JFrog (OAuth) module

[bpmct]

A discussion dedicated to the JFrog (OAuth) module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
19 / 25	18 / 20	2 / 20	8 / 10	63 / 100

Drilldown

Presentation & Onboarding — 19 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	Multiple documented examples covering different package managers (npm, go, pypi, docker, conda, maven), code-server integration, and using the access token in other terraform resources. Each example shows sensible defaults and clear configuration patterns.
Coder-context framing	8	7	README explains this is a Coder module using external-auth for OAuth, names both Coder and JFrog/Artifactory, and links to Coder docs. However, the flow description could be clearer about where Coder fits in the authentication sequence.
Visual preview	5	0	README references  but the actual image file is not included in the module files provided.

Credential Hygiene — 18 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	The access_token output is marked sensitive = true. README examples never show inline secrets; they all use the external-auth flow. Template files properly reference ${ARTIFACTORY_ACCESS_TOKEN} variable rather than hardcoding.
Non-hardcoded auth path	4	2	Module uses Coder external-auth OAuth flow, which is a proper non-hardcoded path. However, the README could more prominently document this as the primary authentication method and emphasize that no API keys need to be pasted into templates. The Prerequisites section mentions it but not as prominently as it could.

Restricted-Environment Readiness — 2 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	0	The JFrog CLI is downloaded from https://install-cli.jfrog.io in run.sh with no module variable to override this URL. The module configures package manager repositories but does not provide a way to mirror the CLI installation source itself.
Bring-your-own binary	5	0	No documented way to skip JFrog CLI installation. The script checks if command -v jf and skips installation if already present, but this is not documented in the README as a supported pattern for pre-baked images.
Egress transparency	3	0	No dedicated README section enumerating external endpoints. The install script contacts install-cli.jfrog.io and the user's JFrog instance, but these are not enumerated in a network/offline/air-gapped section.
Runs without sudo	2	2	The install script uses sudo for JFrog CLI installation (`curl -fL https://install-cli.jfrog.io

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. jfrog_url has URL format validation. username_field has enum validation for email/username. package_managers has detailed description with examples. Sensible defaults provided (username_field = "username", external_auth_id = "jfrog", configure_code_server = false).
Test coverage	4	2	.tftest.hcl file exists with comprehensive Terraform test coverage including validation tests, package manager configuration tests, and edge cases. However, no TypeScript tests are present for end-to-end behavior. Tests only cover Terraform business logic.

Overall — 63 / 100

Raw 47 / 75 → round(47 / 75 × 100) = 63

Track: Utility (This module configures authentication and package manager integration, not an AI agent or IDE)

---

Scored against SCORECARD.md on 2026-07-15 with claude-sonnet-4-5.