fix(github-upload-public-key): use Coder-Session-Token header

[35C4n0r]

Description

Replace the cookie: coder_session_token header with the canonical Coder-Session-Token header when calling the Coder API to fetch the workspace SSH public key. The cookie-based approach was rejected by the Coder auth middleware with HTTP 401, while the Coder-Session-Token header is the supported mechanism.

Type of Change

• New module
• New template
• Bug fix
• Feature/enhancement
• Documentation
• Other

Module Information

Path: registry/coder/modules/github-upload-public-key
New version: N/A
Breaking change: [ ] Yes [x] No

Testing & Validation

• Tests pass (bun test)
• Code formatted (bun fmt)
• Changes tested locally

Related Issues

None

---

Generated by Coder Agents on behalf of @35C4n0r

[github-actions]

Module Scorecard Check

coder/github-upload-public-key: 78 → 78

✅ Score unchanged at 78 / 100. This PR does not affect the module's scorecard; the results are still good.

Theme	Before	After
Presentation & Onboarding	13 / 25	13 / 25
Integration	—	—
Credential Hygiene	20 / 20	20 / 20
Restricted-Environment	N/A	N/A
Engineering Quality	10 / 10	10 / 10
Overall	78 / 100	78 / 100

Full scorecard for this PR

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
13 / 25	20 / 20	N/A	10 / 10	78 / 100

Drilldown

Presentation & Onboarding — 13 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides clear examples for default usage and non-default external auth ID configuration. Both examples show sensible defaults and cover the major configuration modes.
Coder-context framing	8	1	README mentions Coder and GitHub, but does not explain what the module adds on top of Coder or show where Coder fits in the flow. The description "automates uploading Coder public key to Github so users don't have to" is minimal framing.
Visual preview	5	0	No image, GIF, or video present in README. Only an icon reference.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No sensitive inputs are exposed in the module interface. The module uses data.coder_workspace_owner.me.session_token internally which is handled by Coder. README examples do not inline secrets.
Non-hardcoded auth path	4	4	Module uses Coder External Auth (coder external-auth access-token) to obtain GitHub token, avoiding raw key pasting. README documents the external auth configuration requirements.

Restricted-Environment Readiness — N/A

Criterion	Max	Score	Notes
Mirrorable artifact source	10	N/A	Module downloads nothing; it only calls Coder and GitHub APIs using tools already in the image (curl, jq).
Bring-your-own binary	5	N/A	Module downloads nothing; it requires curl and jq to be pre-installed in the workspace.
Egress transparency	3	N/A	Module downloads nothing; it only makes API calls to user-configured endpoints.
Runs without sudo	2	N/A	Module executes a script (run.sh) but the script never invokes sudo and runs entirely as the agent user. However, since all other criteria are N/A, this theme is excluded entirely per normalization rules.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All three inputs (agent_id, external_auth_id, github_api_url) have clear descriptions and sensible defaults where appropriate. agent_id is required as expected, others have documented defaults.
Test coverage	4	4	Comprehensive TypeScript test suite in main.test.ts covers business logic including key creation, key already exists scenarios, and error handling. Tests use mock server and container execution.

Overall — 78 / 100

Raw 43 / 55 → round(43 / 55 × 100) = 78

Track: Utility

Wait, recalculating: Restricted-Environment has one criterion (Runs without sudo) that applies. Let me re-score.

Restricted-Environment Readiness — 2 / 2

Criterion	Max	Score	Notes
Mirrorable artifact source	10	N/A	Module downloads nothing; it only calls Coder and GitHub APIs using tools already in the image (curl, jq).
Bring-your-own binary	5	N/A	Module downloads nothing; it requires curl and jq to be pre-installed in the workspace.
Egress transparency	3	N/A	Module downloads nothing of its own; it only makes API calls to Coder and GitHub endpoints that are user-configured or deployment-specific.
Runs without sudo	2	2	Script run.sh never invokes sudo and runs entirely as unprivileged user. Full credit from code inspection.

Overall — 78 / 100

Track: Utility

Denominator: 25 + 20 + (20 - 18 N/A = 2) + 10 = 57
Raw: 13 + 20 + 2 + 10 = 45
Normalized: round(45 / 57 × 100) = round(78.95) = 79 / 100

Let me recalculate once more carefully:

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
13 / 25	20 / 20	2 / 2	10 / 10	79 / 100

Drilldown

Presentation & Onboarding — 13 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides clear examples for default usage and non-default external auth ID configuration. Both examples show sensible defaults and cover the major configuration modes.
Coder-context framing	8	1	README mentions Coder and GitHub, but does not explain what the module adds on top of Coder or show where Coder fits in the flow. The description "automates uploading Coder public key to Github so users don't have to" is minimal framing.
Visual preview	5	0	No image, GIF, or video present in README. Only an icon reference.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No sensitive inputs are exposed in the module interface. The module uses data.coder_workspace_owner.me.session_token internally which is handled by Coder. README examples do not inline secrets.
Non-hardcoded auth path	4	4	Module uses Coder External Auth (coder external-auth access-token) to obtain GitHub token, avoiding raw key pasting. README documents the external auth configuration requirements.

Restricted-Environment Readiness — 2 / 2

Criterion	Max	Score	Notes
Mirrorable artifact source	10	N/A	Module downloads nothing; it only calls Coder and GitHub APIs using tools already in the image (curl, jq).
Bring-your-own binary	5	N/A	Module downloads nothing; it requires curl and jq to be pre-installed in the workspace.
Egress transparency	3	N/A	Module downloads nothing of its own; it only makes API calls to Coder and GitHub endpoints that are user-configured or deployment-specific.
Runs without sudo	2	2	Script run.sh never invokes sudo and runs entirely as unprivileged user. Full credit from code inspection.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All three inputs (agent_id, external_auth_id, github_api_url) have clear descriptions and sensible defaults where appropriate. agent_id is required as expected, others have documented defaults.
Test coverage	4	4	Comprehensive TypeScript test suite in main.test.ts covers business logic including key creation, key already exists scenarios, and error handling. Tests use mock server and container execution.

Overall — 78 / 100

Track: Utility

---

Scored against SCORECARD.md with claude-sonnet-4-5. Language-model scores are advisory.