Add Mise module - #1068
Open
droopy4096 wants to merge 7 commits into
Open
Conversation
The README validator (cmd/readmevalidation/codermodules.go) requires exactly one 'tf' code block with a 'version' field between the h1 heading and the first h2. Move the primary usage snippet directly under '# mise install' and demote the git-clone composition example to '### Compose with coder/git-clone' under '## Examples'.
The README validator (cmd/readmevalidation/codermodules.go) requires exactly one 'tf' code block with a 'version' field between the h1 heading and the first h2. Move the primary usage snippet directly under '# mise install' and demote the git-clone composition example to '### Compose with coder/git-clone' under '## Examples'.
Author
|
note that I'm adding this asa "community" contribution since it's my first contribution. |
Member
yeah totally! we can move it to "official" if we are seeing heavy use. always good to have more contributors on the list :D |
bpmct
added a commit
that referenced
this pull request
Aug 20, 2026
…ks (#1069) Follow-up to #1065. The `/scorecard` command runs now, but only looks at `registry/coder/modules`, so community-namespace PRs like #1068 report "no changed modules" and get no comment. This makes the PR scorecard check work for modules in any namespace (`registry/<namespace>/modules/<name>`). Module specs are now `namespace/name`, with bare names still meaning the coder namespace. Discussions are still coder-only: - Community modules skip the baseline lookup and always report a standalone advisory score, with report text that says so (no "discussion is created after merge" for them). - The discussion-writing runs (post-merge, weekly) enumerate `registry/coder/modules` only, unchanged. - The script now refuses non-coder specs outside `--pr-report`/`--dry-run`, so a community discussion can't be created by accident. 🤖 Generated with Coder Agents on behalf of @bpmct
bpmct
added a commit
that referenced
this pull request
Aug 20, 2026
…dule content (#1070) Follow-up to #1069. The `/scorecard` run on #1068 detected `droopy4096/mise-install` correctly but failed at the materialize step: ``` error: pathspec 'registry/*/modules' did not match any file(s) known to git ``` Wildcard pathspecs don't directory-prefix match the way literal paths do, so `registry/*/modules` matched nothing. Fixed by overlaying the whole `registry/` tree instead, which is simpler and equally safe: it's all inert data read as text for the scoring prompt, and everything under `.github/` stays at the trusted base. Verified locally against `refs/pull/1068/merge`: the checkout now materializes `registry/droopy4096/modules/mise-install`. 🤖 Generated with Coder Agents on behalf of @bpmct
Member
|
/scorecard |
Contributor
Module Scorecard Check
|
| Presentation & Onboarding | Credential Hygiene | Restricted-Environment Readiness | Engineering Quality | Overall |
|---|---|---|---|---|
| 17 / 25 | 20 / 20 | 20 / 20 | 10 / 10 | 89 / 100 |
Drilldown
Presentation & Onboarding — 17 / 25
| Criterion | Max | Score | Notes |
|---|---|---|---|
| Configuration-mode examples | 12 | 12 | README provides examples for: basic composition with git-clone, disabling shell activation and mise trust, custom install directory, air-gapped/mirrored installer with version pinning, bring-your-own binary mode, and custom wait timeout. Each major mode (default, BYO binary, mirrored) has sensible defaults documented. |
| Coder-context framing | 8 | 5 | README names mise and explains it installs mise and runs mise install inside a cloned repository. Shows composition with coder/git-clone module. However, it does not explicitly explain what Coder is or where Coder fits in the developer workflow—assumes reader already understands Coder context. |
| Visual preview | 5 | 0 | No image, GIF, or video present in README. Icon reference exists but is not embedded as a visual preview. |
Credential Hygiene — 20 / 20
| Criterion | Max | Score | Notes |
|---|---|---|---|
| Secrets marked sensitive | 16 | 16 | No sensitive inputs exist in this module. All variables are configuration paths, URLs, booleans, and timeouts. README examples contain no inline secrets or API keys. Full credit as the concern does not apply. |
| Non-hardcoded auth path | 4 | 4 | Module does not handle authentication credentials. The tool (mise) does not require API keys or secrets for its core install/trust/install workflow. N/A concern; full credit. |
Restricted-Environment Readiness — 20 / 20
| Criterion | Max | Score | Notes |
|---|---|---|---|
| Mirrorable artifact source | 10 | 10 | install_url variable (default https://mise.run) overrides the installer script download URL. README "Air-gapped / mirrored installer" example explicitly shows pointing this at an internal mirror: install_url = "https://artifacts.internal.example.com/mise/install.sh". The variable directly replaces the download source in the install path. |
| Bring-your-own binary | 5 | 5 | install_mise = false disables download entirely. README documents this in the "Air-gapped / mirrored installer" example: "Bring-your-own binary: the image already ships mise; skip the download." Combined with optional mise_bin variable to point at a pre-installed binary. |
| Egress transparency | 3 | 3 | Dedicated "Network egress" README section enumerates all external endpoints: https://mise.run (installer), https://github.com/jdx/mise/releases/* (transitive from installer), https://mise.jdx.dev/* (plugin registry), and language-runtime hosts (transitive from mise install). Table shows when each is contacted and which variables override them. Notes for restricted environments included. |
| Runs without sudo | 2 | 2 | Inspected scripts/install.sh.tftpl and scripts/post_install.sh.tftpl. Neither script invokes sudo at any point. Install writes to user-specified $HOME/.local/bin (or custom install_dir), appends to user rc files, and runs mise commands—all as unprivileged user. Full credit from code inspection. |
Engineering Quality — 10 / 10
| Criterion | Max | Score | Notes |
|---|---|---|---|
| Input quality | 6 | 6 | All 11 input variables have clear descriptions. Sensible defaults provided (e.g., install_dir = "$HOME/.local/bin", wait_seconds = 300, activate_shells = ["bash", "zsh"]). Validation blocks present for activate_shells (must be bash/zsh) and wait_seconds (non-negative). |
| Test coverage | 4 | 4 | .tftest.hcl file present with 9 test runs covering: required vars, invalid shell validation, empty shells, negative wait validation, custom wait, custom install URL, pinned version, install_mise=false, BYO binary, and apply with output assertions. Tests focus on input validation and plan/apply behavior. No TypeScript e2e tests, but this is a utility module with no interactive UI component, so Terraform tests are appropriate coverage. |
Overall — 89 / 100
Raw 67 / 75 → round(67 / 75 × 100) = 89
Scored against SCORECARD.md with claude-sonnet-4-5. Language-model scores are advisory.
bpmct
reviewed
Aug 20, 2026
bpmct
approved these changes
Aug 20, 2026
bpmct
left a comment
bpmct
left a comment
Member
There was a problem hiding this comment.
Down to merge as-is, but kicked off a scorecard if there is anything you want to improve here! Thanks for the PR. this is super solid
| @@ -0,0 +1,111 @@ | |||
| --- | |||
| display_name: mise install | |||
Member
There was a problem hiding this comment.
Wondering if we should just call it mise
Author
There was a problem hiding this comment.
it both installs mise and installs components using mise so I felt like name fits, but I'm open to change that.
Author
There was a problem hiding this comment.
also: working through scorecard-related improvements
…mise, mise_bin, egress docs) Addresses the Restricted-Environment Readiness feedback from the PR scorecard (coder#1068 scored 2/20 on this category). Mirrorable artifact source: - Add 'install_url' variable (default https://mise.run) so operators can point the installer at an internal mirror. - Add 'mise_version' variable that, when non-empty, exports MISE_VERSION before piping the installer to sh for reproducible pinning. Bring-your-own binary: - Add 'install_mise' bool (default true). When false, the install script skips the download and expects mise to be provided by the workspace image. - Add 'mise_bin' string variable pointing at a pre-installed mise binary; when set, its directory is prepended to PATH for both the install and post-install scripts. The install script validates it is executable and fails loudly if mise is not on PATH after the install phase. Shell activation resolves mise via 'command -v mise' so the rc-file eval line uses an absolute path regardless of source. Egress transparency: - Add a dedicated 'Network egress' README section enumerating every external endpoint the module (or its transitive downloads) reach, which variable overrides each, and guidance for fully air-gapped workspaces. - Add an 'Air-gapped / mirrored installer' example demonstrating the three new variables together (mirror + pinned version + BYO binary). - Move the stray egress note out of Troubleshooting and link to the new section instead. Also: - Move the module logo from a module-local .icons/logo.svg to the repo-level .icons/mise.svg so it conforms to the CONTRIBUTING rule that module icons must live in the top-level /.icons directory and be referenced as ../../../../.icons/<icon>.svg. - Add tftest cases for the four new inputs. Tests: 10 passed, 0 failed.
Author
|
/scorecard |
Member
|
looks like it edited the thing above @droopy4096 |
Author
I don't think there's much I can do to improve things further. This is as good as it gets at least score-wise |
Member
|
yeah agreed. i dont like the "explain coder" part of my scorecard thing haha |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Type of Change
Module Information
Path:
registry/droopy4096/modules/mise-installNew version:
v1.0.0Breaking change: [ ] Yes [x] No
Testing & Validation
bun test)bun fmt)Related Issues