JFrog (Token) module

[bpmct]

A discussion dedicated to the JFrog (Token) module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
19 / 25	10 / 20	2 / 20	8 / 10	52 / 100

Drilldown

Presentation & Onboarding — 19 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	Multiple examples cover different package manager combinations (npm/go/pypi, local repos only, code-server integration, custom token description, using token in other resources). Each shows sensible defaults.
Coder-context framing	8	7	README explains this installs JF CLI and authenticates package managers with Artifactory using the Artifactory terraform provider. Names both Coder and JFrog/Artifactory. Shows Coder fits in the workspace provisioning flow. Slightly under-documented on the exact Coder integration points beyond agent_id.
Visual preview	5	0	README references  but the actual image file is not included in the module files provided. Icon reference exists but icons don't count per rubric.

Credential Hygiene — 10 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	8	The artifactory_access_token variable is NOT marked sensitive = true in main.tf. The output access_token is marked sensitive. README examples show artifactory_access_token = var.artifactory_access_token which avoids inline literals, but the variable definition itself lacks the sensitive flag, capping this at half.
Non-hardcoded auth path	4	2	Module uses Artifactory provider with access token. README mentions "An admin access token" in comments but doesn't document alternative auth methods like ServiceAccount, IAM, OAuth, or API key helpers. The token must be provided directly. Partial credit for using a provider-based approach rather than raw API calls.

Restricted-Environment Readiness — 2 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	0	The JF CLI is downloaded from hardcoded https://install-cli.jfrog.io in run.sh with no module variable to override this URL. No download URL override variable exists.
Bring-your-own binary	5	0	No documented way to skip JF CLI installation when it's already in the image. The script checks if command -v jf and skips installation if found, but this is not documented in README. Per rubric, undocumented capability scores 0.
Egress transparency	3	0	No dedicated README section enumerating external endpoints. Endpoints are scattered across examples (jfrog.io URLs) but not consolidated. Per rubric, without a dedicated section, at most half; scattered mentions without enumeration earn 0.
Runs without sudo	2	2	Script uses sudo for JF CLI installation (`curl -fL https://install-cli.jfrog.io

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	Variables have clear descriptions, sensible defaults (check_license=true, refreshable=false, configure_code_server=false), and validation rules (jfrog_url regex for http/https, username_field enum validation). Package_managers uses optional() with empty list defaults. Well-structured.
Test coverage	4	2	TypeScript tests in main.test.ts cover business logic (npmrc generation, pip config, docker registration, go proxy, conda, maven). Tests use a fake JFrog server to avoid remote calls. However, no .tftest.hcl files are present for Terraform-native testing. Per rubric, tests should primarily use .tftest.hcl for business logic. Half credit for comprehensive TypeScript tests but missing Terraform tests.

Overall — 52 / 100

Raw 39 / 75 → round(39 / 75 × 100) = 52

Track: Utility (configures package managers and artifact authentication, not an agent or IDE)

---

Scored against SCORECARD.md on 2026-08-03 with claude-sonnet-4-5.