[35C4n0r]

Description

Stacked on #1193. Addresses this review comment.

GitHub's key list endpoints return 30 keys per page by default, so a Coder key beyond the first page was missed and the module tried to upload it again. upload_key now requests per_page=100 and keeps fetching pages until it finds the key or gets a page shorter than 100. This applies to both /user/keys and /user/ssh_signing_keys.

Type of Change

• New module
• New template
• Bug fix
• Feature/enhancement
• Documentation
• Other

Module Information

Path: registry/coder/modules/github-upload-public-key
New version: v1.2.0 (unreleased; same version as #1193)
Breaking change: [ ] Yes [x] No

Testing & Validation

• Tests pass (bun test): 10/10, with a new case where the key is on the second page for both endpoints. This case fails on the feat(coder/github-upload-public-key): add key_type to upload SSH signing keys #1193 script.
• Code formatted (bun fmt)
• Changes tested locally against real GitHub

Related Issues

Stacked on #1193

---

Note

This PR was generated by Coder Agents on behalf of @35C4n0r, using Claude.

[github-actions]

Module Scorecard Check

coder/github-upload-public-key: 78 → 90

✅ Score improvement: 78 → 90 (+12).

Theme	Before	After
Presentation & Onboarding	6 / 17	12 / 17
Integration	—	—
Credential Hygiene	20 / 20	20 / 20
Restricted-Environment	2 / 2	2 / 2
Engineering Quality	10 / 10	10 / 10
Overall	78 / 100	90 / 100

Full scorecard for this PR

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
12 / 17	20 / 20	2 / 2	10 / 10	90 / 100

Drilldown

Presentation & Onboarding — 12 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README documents all major modes: key_type (auth, signing, both) with dedicated examples, external_auth_id with a non-default-ID example, and key_name with a usage example. Sensible defaults are stated for each.
Visual preview	5	0	No image, GIF, or video embedded in the README. The frontmatter icon field references an SVG icon, which does not count.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No module input is a secret; the session token is obtained via data.coder_workspace_owner.me.session_token (Coder-managed). README examples contain no inline secrets in module usage. The CODER_EXTERNAL_AUTH_0_CLIENT_SECRET=xxxxxxx line documents Coder deployment prerequisites, not a module input.
Non-hardcoded auth path	4	4	The module uses coder external-auth access-token to obtain a GitHub token at runtime. README explicitly documents the GitHub External Auth prerequisite and the required scopes, providing a clear path that avoids pasting raw API keys into templates.

Restricted-Environment Readiness — 2 / 2 (18 pts N/A)

Criterion	Max	Score	Notes
Mirrorable artifact source	5	N/A	Module downloads and installs nothing of its own. It invokes curl, jq, and the coder CLI already present in the image. No download URL to override.
Bring-your-own binary	10	N/A	Module does not download or install any tool. curl and jq are prerequisites the user must pre-install; there is no install step to skip.
Egress transparency	3	N/A	Module downloads nothing of its own. It only calls the Coder API and the GitHub API at runtime.
Runs without sudo	2	2	run.sh never invokes sudo. All operations (curl, jq, coder CLI) run as the unprivileged workspace user.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All five variables have clear description fields, sensible defaults (external_auth_id = "github", github_api_url = "https://api.github.com", key_type = "auth", key_name = null), and key_type includes a validation block restricting values to auth/signing/both.
Test coverage	4	4	main.tftest.hcl covers business logic (key_type default, signing, both, invalid rejection). main.test.ts provides end-to-end tests executing the actual run.sh in a container against a mock GitHub API server, covering: new key creation, custom/special-character key names, idempotency, signing-only, both, pagination, and skip-existing.

Overall — 90 / 100

Raw 44 / 49 → round(44 / 49 × 100) = 90

Tip

You can run this locally by telling your agent: "review this module against .github/scorecard/SCORECARD.md".

---

Scored against SCORECARD.md with solstice-1. Language-model scores are advisory.

[Edd88-pixel]

LGTM, thanks