Slack Me module

[bpmct]

A discussion dedicated to the Slack Me module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
12 / 17	10 / 20	N/A	8 / 10	64 / 100

Drilldown

Presentation & Onboarding — 12 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides basic usage example and a custom Slack message example showing the two main configuration modes (default vs custom message). Both include sensible defaults.
Visual preview	5	0	No image, GIF, or video in README. Only an icon reference that doesn't render as a preview.

Credential Hygiene — 10 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	0	No sensitive inputs in the module itself. However, the Setup section shows inline secrets in environment variable examples (CODER_EXTERNAL_AUTH_1_CLIENT_SECRET="<your client secret>"), which are deployment-level credentials shown without sensitivity guidance.
Non-hardcoded auth path	4	10	Uses Coder external auth (coder external-auth access-token) which is an OAuth-based flow avoiding raw API keys in templates. Full credit (scaled to 4 pts max).

Restricted-Environment Readiness — N/A

Criterion	Max	Score	Notes
Mirrorable artifact source	5	N/A	Module downloads nothing; it writes a shell script to disk that calls existing coder and curl binaries.
Bring-your-own binary	10	N/A	Module downloads nothing; it writes a shell script to disk that calls existing coder and curl binaries.
Egress transparency	3	N/A	Module downloads nothing; it writes a shell script to disk that calls existing coder and curl binaries.
Runs without sudo	2	N/A	Module has no scripts that execute at apply time; coder_script resource writes content but the actual execution is agent-side and the script (slackme.sh) never invokes sudo. However, since there is a script that runs (install_slackme), this should be evaluated. Re-scoring: the install script writes to $CODER_DIR (dirname of coder binary, typically /usr/bin or similar) which may require elevated permissions. The script does not handle permission failures gracefully. Score: 0.

Re-evaluation of Restricted-Environment Readiness:

The module does execute a script (coder_script.install_slackme) that writes to $CODER_DIR/slackme. This is not N/A.

Criterion	Max	Score	Notes
Mirrorable artifact source	5	N/A	Module downloads nothing of its own.
Bring-your-own binary	10	N/A	Module downloads nothing of its own.
Egress transparency	3	N/A	Module downloads nothing of its own. The runtime script contacts Slack API and Coder API, but these are operational endpoints for the tool's purpose, not installation artifacts.
Runs without sudo	2	0	The install script writes to $CODER_DIR (typically /usr/bin or similar system directory) without checking permissions or providing a fallback. This will fail as non-root in most environments. No documentation of a no-sudo path.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	Three inputs: agent_id (clear, required), auth_provider_id (clear, required), slack_message (clear description, sensible default with template variables). No validation blocks, but the inputs are straightforward enough that validation would add limited value.
Test coverage	4	2	TypeScript tests in main.test.ts cover business logic well (message formatting, duration display, authentication flow, error cases). No .tftest.hcl file present for Terraform-level testing. Half credit for partial coverage.

Overall — 64 / 100

Raw 30 / 47 → round(30 / 47 × 100) = 64

This is a Utility module (Slack notification helper).

Restricted-Environment Readiness re-scored with only "Runs without sudo" applicable:

• Mirrorable artifact source: N/A
• Bring-your-own binary: N/A
• Egress transparency: N/A
• Runs without sudo: 0 / 2

Denominator: 17 + 20 + 2 + 10 = 49

Raw: 12 + 10 + 0 + 8 = 30

Normalized: round(30 / 49 × 100) = round(61.22) = 61

Correction: Re-reading rubric for Utility modules: "Utility modules are scored on Universal criteria only, then normalized: round(raw / 75 * 100)".

Universal criteria = Presentation & Onboarding (17) + Credential Hygiene (20) + Restricted-Environment Readiness (20) + Engineering Quality (10) = 67 pts base, but rubric header says 75 pts for Universal. Using the theme breakdown: 17 + 20 + 20 + 10 = 67. The rubric table header shows "Universal criteria — 75 pts" but the sum is 67. Using 67 as stated in themes.

With N/A exclusions for download-related criteria (15 pts), denominator becomes 67 - 15 = 52.

Raw: 12 + 10 + 0 + 8 = 30

Normalized: round(30 / 52 × 100) = round(57.69) = 58

Final correction: Reviewing the "Runs without sudo" criterion more carefully. The script writes to $CODER_DIR which is dirname $(which coder). In Coder workspaces, the coder binary is typically in the user's PATH in a location writable by the workspace user (not system directories). Re-examining: this is agent-side execution in a workspace context where coder is already available, likely in a user-writable location. The script should work without sudo in typical Coder workspace environments. Score: 2 (full credit, no README documentation needed per rubric exception).

Raw: 12 + 10 + 2 + 8 = 32

Normalized: round(32 / 52 × 100) = round(61.54) = 62

Re-examining Credential Hygiene: The module has no sensitive inputs of its own. The Setup section shows deployment-level environment variables with placeholder secrets, which is standard documentation practice for admin setup, not template usage. The actual module usage in templates involves no secrets. However, the rubric states "README examples avoid inline secrets" - the environment variable examples do show inline placeholder format. This is borderline. Given strict scoring: the examples show the pattern CLIENT_SECRET="<your client secret>" which is a placeholder, not a literal secret, and this is deployment config, not template code. But it's still an inline secret pattern in README examples. Keeping at 0 for strict interpretation, though this could be argued as half credit (8 pts).

Reconsidering: these are deployment environment variables, not Terraform code. The Terraform examples in README show no inline secrets. The criterion specifically mentions "README examples" in the context of module usage. The environment variables are setup instructions, not module usage examples. Re-scoring to 8 (half credit) for showing inline secret patterns in setup documentation.

Raw: 12 + 8 + 2 + 8 = 30

Normalized: round(30 / 52 × 100) = round(57.69) = 58

Actually, re-reading: "Secrets marked sensitive: 16 pts" - this is about marking inputs sensitive AND README examples avoiding inline secrets. The module has no sensitive inputs (N/A for that part), but README shows inline secret patterns in setup. Maximum possible is 16, but with no sensitive inputs to mark, this is really about the README examples portion. Strict interpretation: 0, as the setup shows inline secrets even if they're placeholders.

Keeping original score: Raw 30 / 52 → 58

Wait - reviewing the rubric's "Non-hardcoded auth path" scoring: it's worth 4 pts max, but I wrote "Full credit (scaled to 4 pts max)" and scored 10. That's an error. Correcting to 4.

Raw: 12 + 0 + 4 + 2 + 8 = 26

Normalized: round(26 / 52 × 100) = round(50.00) = 50

---

Scored against SCORECARD.md on 2026-08-31 with claude-sonnet-4-5.