JFrog (Token) module

[bpmct]

A discussion dedicated to the JFrog (Token) module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
17 / 17	10 / 20	2 / 20	10 / 10	58 / 100

Drilldown

Presentation & Onboarding — 17 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides multiple documented examples covering major modes: token-only mode (no CLI/package managers), package manager configuration (npm/go/pypi/docker/conda/maven), code-server integration, custom token description, and using the access token in other terraform resources. Each has sensible defaults.
Visual preview	5	5	README includes  and the image file exists at 56.0 KB.

Credential Hygiene — 10 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	8	The artifactory_access_token variable lacks sensitive = true marking. The access_token output is marked sensitive = true. README examples show artifactory_access_token = var.artifactory_access_token which references a variable, but the initial assignment would require the literal token somewhere. This is partial implementation.
Non-hardcoded auth path	4	2	The module uses the Artifactory terraform provider to generate scoped tokens from an admin token, which is a form of token exchange. However, the admin token itself must still be provided as a raw credential. This is a partial improvement over direct credential use but not a full external auth path like IAM/OAuth.

Restricted-Environment Readiness — 2 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	The JFrog CLI is downloaded from a hardcoded URL https://install-cli.jfrog.io in run.sh. No module variable allows overriding this download URL to point to an internal mirror.
Bring-your-own binary	10	2	The install_jfrog_cli = false variable disables installation, and the README documents token-only mode and pre-installed CLI usage. However, the script exits with error if CLI is required but missing (exit 1), rather than gracefully degrading. The documented pre-installed path works but requires careful configuration. This earns minimal credit for partial support.
Egress transparency	3	0	No dedicated README section enumerates external endpoints. The https://install-cli.jfrog.io download URL and user-provided jfrog_url are scattered across examples and code, not consolidated in a network/air-gap section.
Runs without sudo	2	0	The run.sh script uses sudo sh and sudo chmod for JFrog CLI installation (lines: curl -fL https://install-cli.jfrog.io | sudo sh and sudo chmod 755 /usr/local/bin/jf). While installation can be disabled, when enabled, sudo is required for core installation functionality with no documented fallback.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	Variables have clear descriptions, sensible defaults (e.g., jfrog_server_id = "0", check_license = true, package_managers = {}), and validation rules (e.g., jfrog_url must start with http/https, username_field must be email or username).
Test coverage	4	4	.tftest.hcl covers business logic with three test cases (defaults, token-only mode, package manager configuration). main.test.ts provides comprehensive end-to-end tests for all package managers (npm, go, pypi, docker, conda, maven) with a mock JFrog server, verifying generated configurations.

Overall — 58 / 100

Raw 39 / 67 → round(39 / 67 × 100) = 58

Wait, recalculating: This is a Utility module (JFrog integration/authentication helper, not an agent or IDE).

Utility scoring: Universal criteria only (67 pts max before N/A), then normalize.

Universal raw: 17 + 10 + 2 + 10 = 39
Denominator: 67 (no N/A exclusions; the module does download the JFrog CLI)
Normalized: round(39 / 67 × 100) = round(58.2) = 58

---

Scored against SCORECARD.md on 2026-09-02 with claude-sonnet-4-5.