JFrog (Token) module

[bpmct]

A discussion dedicated to the JFrog (Token) module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
19.5 / 25	10 / 20	2.5 / 20	8 / 10	53 / 100

Drilldown

Presentation & Onboarding — 19.5 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	Multiple examples cover different package manager combinations (npm/go/pypi, local repos only, code-server integration, custom token description, using token in other resources). Each shows sensible defaults.
Coder-context framing	8	7.5	README states "Install the JF CLI and authenticate package managers with Artifactory using Artifactory terraform provider" and mentions Coder workspace context. Links to Coder docs guide. Does not explicitly explain where Coder fits in the authentication flow, just that it integrates. Nearly full.
Visual preview	5	0	README references  but the actual image file is not included in the module files provided. Icon reference exists but icons don't count per rubric.

Credential Hygiene — 10 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	8	artifactory_access_token variable is not marked sensitive = true in main.tf. README examples show artifactory_access_token = var.artifactory_access_token which avoids inline secrets in examples, but the variable definition itself lacks the sensitive flag. Output access_token is marked sensitive. Half credit.
Non-hardcoded auth path	4	2	Module uses Artifactory provider with an admin access token to create scoped tokens. This is token-based auth, not ServiceAccount/IAM/OAuth. The scoped token approach is better than raw admin tokens everywhere, but still requires pasting an admin token into the template. Partial credit for the scoping mechanism.

Restricted-Environment Readiness — 2.5 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	0	JFrog CLI is installed via `curl -fL https://install-cli.jfrog.io
Bring-your-own binary	5	0	Script checks if command -v jf and skips installation if present, but this is not documented in README. No documented way to disable download when tool is pre-baked.
Egress transparency	3	1.5	No dedicated README section for network requirements or air-gapped environments. Endpoints are scattered: install-cli.jfrog.io for CLI install, user's jfrog_url for Artifactory API, package manager repos. Inferable but not enumerated in a dedicated section. Half credit.
Runs without sudo	2	1	run.sh uses sudo sh for JFrog CLI installation and sudo chmod 755 /usr/local/bin/jf. Core functionality (CLI install) requires sudo. If CLI is pre-installed, the rest runs without sudo, but install is part of the module's purpose. Half credit for the fallback when pre-installed.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	Variables have clear descriptions. jfrog_url has validation for http/https. username_field has validation for email/username. package_managers has detailed description with example. Sensible defaults where appropriate (check_license, refreshable, username_field).
Test coverage	4	2	main.test.ts has TypeScript tests covering npmrc generation, pip config, docker, go, conda, maven with multiple repos. Tests use a fake JFrog server. No .tftest.hcl file present for Terraform native tests. Half credit for TypeScript-only coverage.

Overall — 53 / 100

Raw 40 / 75 → round(40 / 75 × 100) = 53

(Utility track: denominator 75, normalized to 100)

---

Scored against SCORECARD.md on 2026-08-10 with claude-sonnet-4-5.