JetBrains Toolbox module

[bpmct]

A discussion dedicated to the JetBrains Toolbox module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	IDE Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
25 / 25	18 / 25	20 / 20	13 / 20	9 / 10	85 / 100

Drilldown

Presentation & Onboarding — 25 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides examples for pre-configured mode (direct app creation with default), user choice with limited options, EAP versions, pinned versions (air-gapped), single IDE use case, and custom tooltip. Each major mode is documented with sensible defaults.
Coder-context framing	8	8	README clearly states "This module adds JetBrains IDE buttons to launch IDEs directly from the dashboard by integrating with the JetBrains Toolbox." Names both Coder and JetBrains, explains what the module adds on top of Coder.
Visual preview	5	5	README includes  showing the module in action.

IDE Integration — 18 / 25

Criterion	Max	Score	Notes
Dashboard entry point	7	7	Module creates coder_app resources with proper jetbrains://gateway/coder URLs. The apps are documented and functional.
Managed configuration	6	0	No documented support for managed IDE settings, extensions, or configuration files. The module only handles launching IDEs, not configuring them.
Configurable folder or workdir	6	6	The folder variable is required and documented: "The directory to open in the IDE. e.g. /home/coder/project". Validation ensures it's a full path.
Pre-installed extensions	6	5	N/A - JetBrains IDEs are not web IDEs; they are desktop applications launched via Toolbox. This criterion does not apply.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	Module has no secret inputs. The URL uses $SESSION_TOKEN which is a Coder-provided variable, not a user-supplied secret. README examples contain no inline secrets.
Non-hardcoded auth path	4	4	Authentication uses Coder's $SESSION_TOKEN mechanism, avoiding raw key management entirely.

Restricted-Environment Readiness — 13 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	5	releases_base_link and download_base_link variables allow overriding the JetBrains API and download URLs. However, the module itself doesn't download or install anything—it only fetches metadata and constructs URLs for the Toolbox client. The actual IDE downloads are handled by JetBrains Toolbox on the user's machine, not by this module. Half credit for providing URL override capability even though the module doesn't perform downloads.
Bring-your-own binary	5	5	The ide_config variable allows completely bypassing the HTTP API calls: "When set, all HTTP calls are skipped and the provided build numbers are used directly — useful for air-gapped environments or pinning specific versions." Documented with examples.
Egress transparency	3	1.5	The "Pinned Versions (Air-Gapped / Cached)" example mentions that ide_config "makes zero HTTP calls" and lists the JetBrains releases API endpoint in a tip block. However, there is no dedicated README section enumerating all external endpoints contacted at install and runtime. Endpoints are scattered across examples. Half credit.
Runs without sudo	2	1.5	The module contains no install or runtime scripts—it only creates Terraform resources (coder_app, coder_parameter, data.http). The data.http resource runs during Terraform plan/apply, not in the workspace. The actual IDE launch is handled by JetBrains Toolbox on the user's machine. Since there are no scripts to inspect, this criterion is borderline N/A, but the module does make HTTP calls via Terraform which run as the Terraform user (typically unprivileged). Half credit for no sudo requirement in practice, though technically no scripts exist.

Engineering Quality — 9 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. Sensible defaults are provided (major_version = "latest", channel = "release", options includes all supported IDEs). Comprehensive validation rules check format, allowed values, cross-variable constraints (e.g., ide_config must be superset of options and default).
Test coverage	4	3	.tftest.hcl provides extensive business logic coverage: parameter vs direct app creation, URL construction, version resolution, ide_config behavior, validation rules. Tests use plan and apply commands appropriately. No TypeScript end-to-end tests are present, but the module is purely Terraform with no runtime components to test. Half credit deducted for lack of integration tests, though the test coverage is otherwise strong.

Overall — 85 / 100

---

Scored against SCORECARD.md on 2026-07-15 with claude-sonnet-4-5.