Dotfiles module

[bpmct]

A discussion dedicated to the Dotfiles module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
17 / 25	20 / 20	N/A	10 / 10	85 / 100

Drilldown

Presentation & Onboarding — 17 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	Multiple documented examples covering major modes: apply as current user, apply as another user (with sudo), apply to both current user and root, setting default dotfiles repository, custom branch configuration. Each has sensible defaults and clear use cases.
Coder-context framing	8	5	README mentions "coder dotfiles command" and links to Coder docs, names both Coder and dotfiles. However, lacks explicit explanation of what the module adds on top of Coder's built-in dotfiles support or where Coder fits in the developer flow. The value proposition is implicit rather than clearly stated.
Visual preview	5	0	No image, GIF, or video in README. Only an icon reference in frontmatter.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No sensitive inputs in this module. The dotfiles_uri is a repository URL, not a secret. README examples show repository URLs without inline secrets. Module appropriately does not mark non-sensitive inputs as sensitive.
Non-hardcoded auth path	4	4	README explicitly documents SSH URL support as an alternative to HTTPS: "If your Git provider restricts HTTPS cloning, use an SSH URL instead" with examples. SSH URLs use the workspace's SSH key, avoiding token-based auth. The description variable default also mentions SSH URLs.

Restricted-Environment Readiness — N/A

Criterion	Max	Score	Notes
Mirrorable artifact source	10	N/A	Module downloads nothing of its own. It invokes the coder dotfiles command (already in the agent) to clone a user-provided repository URL. The repository URL is user-controlled input, not a module-managed download.
Bring-your-own binary	5	N/A	Module requires the coder binary but does not install it; assumes it exists in the agent. No download or install logic to disable.
Egress transparency	3	N/A	Module makes no external network calls of its own. It clones user-specified repositories, but those endpoints are determined by user input, not the module.
Runs without sudo	2	N/A	Module executes run.sh script, but the script only uses sudo when var.user is set to a different user than $USER. When var.user is null or equals current user, no sudo is invoked. However, since the module does execute scripts, this should be evaluated rather than N/A. Changing to scored.

Re-evaluating Restricted-Environment Readiness with Runs without sudo scored:

Restricted-Environment Readiness — 2 / 2

Criterion	Max	Score	Notes
Mirrorable artifact source	10	N/A	Module downloads nothing of its own. It invokes the coder dotfiles command (already in the agent) to clone a user-provided repository URL. The repository URL is user-controlled input, not a module-managed download.
Bring-your-own binary	5	N/A	Module requires the coder binary but does not install it; assumes it exists in the agent. No download or install logic to disable.
Egress transparency	3	N/A	Module makes no external network calls of its own. It clones user-specified repositories, but those endpoints are determined by user input, not the module.
Runs without sudo	2	2	run.sh script only invokes sudo when var.user is set to a different user. Default behavior (var.user = null) runs as current user without sudo. Script includes validation and works without sudo for core functionality. README documents the sudo requirement only for the "apply as another user" use case.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. Sensible defaults: order/group null, description provides helpful user guidance, default_dotfiles_uri empty string, user null. Comprehensive validation blocks: dotfiles_uri regex validates URL format and prevents injection, dotfiles_branch prevents empty strings, user validates username format.
Test coverage	4	4	main.test.ts provides comprehensive coverage: tests required variables, default output behavior, valid/invalid URL formats including injection attempts, bash compatibility for fish shell, custom parameter ordering, branch configuration, and parameter creation logic. Tests cover both Terraform validation and shell-side URI validation.

Overall — 85 / 100

Raw 47 / 55 → round(47 / 55 × 100) = 85

(Utility module: denominator excludes N/A Restricted-Environment criteria totaling 18 points, leaving 52. Normalized to 100.)

---

Scored against SCORECARD.md on 2026-08-10 with claude-sonnet-4-5.