JetBrains Gateway module

[bpmct]

A discussion dedicated to the JetBrains Gateway module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	IDE Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
25 / 25	18 / 25	20 / 20	8 / 20	8 / 10	79 / 100

Drilldown

Presentation & Onboarding — 25 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	Multiple documented examples cover major modes: default usage, specific IDE selection, latest vs fixed versions, EAP channel, custom base links. Each has sensible defaults.
Coder-context framing	8	8	README clearly names both Coder and JetBrains Gateway, explains the module adds a one-click button to the dashboard, and shows where Coder fits (workspace access via Gateway). Includes recommendation for Toolbox alternative.
Visual preview	5	5	README includes  showing the module in action.

IDE Integration — 18 / 25

Criterion	Max	Score	Notes
Dashboard entry point	7	7	coder_app resource with proper external launch behavior via jetbrains-gateway:// URL scheme.
Managed configuration	6	6	Documented support for managed IDE selection via coder_parameter, version pinning via jetbrains_ide_versions, channel selection, and custom download/release links.
Configurable folder or workdir	6	5	folder variable with validation documented in examples. However, validation error message references ~ but regex doesn't explicitly check for it, slightly awkward.
Pre-installed extensions	6	0	Not applicable to Gateway (client-side IDE launcher, not a web IDE). However, rubric states N/A only for "if applicable" criteria; this is a track criterion, so scores 0.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No sensitive inputs in this module. Uses $SESSION_TOKEN placeholder in URL which is handled by Coder runtime. No inline secrets in examples.
Non-hardcoded auth path	4	4	Uses Coder's built-in $SESSION_TOKEN mechanism, avoiding raw key management entirely.

Restricted-Environment Readiness — 8 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	5	download_base_link and releases_base_link variables allow overriding download URLs. However, these only affect the URL embedded in the Gateway launch link, not an actual download performed by the module. The module itself downloads nothing; Gateway client downloads the IDE. Documented in "Custom base link" example but explanation is awkward (references IDEA offline mode). Half credit for partial/awkward implementation.
Bring-your-own binary	5	0	No documented way to skip IDE download entirely. The module always constructs a download link for Gateway to use.
Egress transparency	3	1.5	External endpoints are inferable from code (data.services.jetbrains.com, download.jetbrains.com) and mentioned in custom base link example, but no dedicated README section enumerating endpoints for restricted environments. Half credit.
Runs without sudo	2	2	Module contains no scripts; only Terraform resources. N/A would apply, but since this is "if applicable" and module has no scripts by construction, full credit (no sudo needed).

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	5	Most inputs have clear descriptions and validation (arch, folder, channel, jetbrains_ides with multiple validations). However, releases_base_link and download_base_link have empty descriptions. Half point deduction.
Test coverage	4	3	TypeScript tests in main.test.ts cover basic functionality (default values, IDE selection, agent name handling). No .tftest.hcl files present. Tests cover behavior but not comprehensive business logic scenarios. Half credit deduction for missing Terraform tests.

Overall — 79 / 100

---

Scored against SCORECARD.md on 2026-08-10 with claude-sonnet-4-5.