feat(release.config.cjs): specify exported semantic-release object as GlobalConfig type

fix: Git repo URL protocols (use SSH in package.json and HTTPS in release.config.cjs)
docs: clarify code comments
2024-04-04 21:17:49 -04:00 · 2024-04-04 21:16:10 -04:00 · 2024-04-04 21:14:15 -04:00 · 2024-04-04 16:34:09 -04:00 · 2024-04-04 16:28:41 -04:00 · 2024-04-03 18:36:21 -04:00
23 changed files with 7022 additions and 37401 deletions
--- a/.github/workflows/acceptance-test.yml
+++ b/.github/workflows/acceptance-test.yml
@@ -1,118 +0,0 @@
-name: Acceptance test
-
-on:
-  workflow_call:
-    inputs:
-      secret:
-        required: true
-        type: string
-      secret-in-section:
-        required: true
-        type: string
-      multiline-secret:
-        required: true
-        type: string
-      export-env:
-        required: true
-        type: boolean
-      version:
-        required: false
-        type: string
-        default: "latest"
-      os:
-        required: true
-        type: string
-        default: "ubuntu-latest"
-      auth:
-        required: true
-        type: string
-
-jobs:
-  acceptance-test:
-    runs-on: ${{ inputs.os }}
-    steps:
-      - name: Base checkout
-        uses: actions/checkout@v4
-        if: |
-          github.event_name != 'repository_dispatch' &&
-          (
-            github.ref == 'refs/heads/main' || 
-            (
-              github.event_name == 'pull_request' && 
-              github.event.pull_request.head.repo.full_name == github.repository
-            )
-          )
-      - name: Fork based /ok-to-test checkout
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.client_payload.pull_request.head.sha }}
-        if: |
-          github.event_name == 'repository_dispatch' &&
-          github.event.client_payload.slash_command.args.named.sha != '' &&
-          contains(
-            github.event.client_payload.pull_request.head.sha,
-            github.event.client_payload.slash_command.args.named.sha
-          )
-      - name: Launch 1Password Connect instance
-        if: ${{ inputs.auth == 'connect' }}
-        env:
-          OP_CONNECT_CREDENTIALS: ${{ secrets.OP_CONNECT_CREDENTIALS }}
-        run: |
-          echo "$OP_CONNECT_CREDENTIALS" > 1password-credentials.json
-          docker compose -f tests/fixtures/docker-compose.yml up -d && sleep 10
-      - name: Configure Service account
-        if: ${{ inputs.auth == 'service-account' }}
-        uses: ./configure
-        with:
-          service-account-token: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
-      - name: Verify Service Account env var is set
-        if: ${{ inputs.auth == 'service-account' }}
-        shell: bash
-        run: |
-          if [ -z "${OP_SERVICE_ACCOUNT_TOKEN}" ]; then
-            echo "OP_SERVICE_ACCOUNT_TOKEN environment variable is not set" >&2
-            exit 1
-          fi
-      - name: Configure 1Password Connect
-        if: ${{ inputs.auth == 'connect' }}
-        uses: ./configure # 1password/load-secrets-action/configure@<version>
-        with:
-          connect-host: http://localhost:8080
-          connect-token: ${{ secrets.OP_CONNECT_TOKEN }}
-      - name: Verify Connect env vars are set
-        if: ${{ inputs.auth == 'connect' }}
-        run: |
-          if [ -z "$OP_CONNECT_HOST" ] || [ -z "$OP_CONNECT_TOKEN" ]; then
-            echo "OP_CONNECT_HOST or OP_CONNECT_TOKEN environment variables are not set" >&2
-            exit 1
-          fi
-      - name: Load secrets
-        id: load_secrets
-        uses: ./ # 1password/load-secrets-action@<version>
-        with:
-          version: ${{ inputs.version }}
-          export-env: ${{ inputs.export-env }}
-        env:
-          SECRET: ${{ inputs.secret }}
-          SECRET_IN_SECTION: ${{ inputs.secret-in-section }}
-          MULTILINE_SECRET: ${{ inputs.multiline-secret }}
-      - name: Verify installed op cli version
-        run: ./tests/assert-cli-version.sh ${{ inputs.version }}
-      - name: Assert test secret values [step output]
-        if: ${{ !inputs.export-env }}
-        env:
-          SECRET: ${{ steps.load_secrets.outputs.SECRET }}
-          SECRET_IN_SECTION: ${{ steps.load_secrets.outputs.SECRET_IN_SECTION }}
-          MULTILINE_SECRET: ${{ steps.load_secrets.outputs.MULTILINE_SECRET }}
-        run: ./tests/assert-env-set.sh
-      - name: Assert test secret values [exported env]
-        if: ${{ inputs.export-env }}
-        run: ./tests/assert-env-set.sh
-      - name: Remove secrets [exported env]
-        if: ${{ inputs.export-env }}
-        uses: ./ # 1password/load-secrets-action@<version>
-        with:
-          unset-previous: true
-      - name: Assert removed secrets [exported env]
-        if: ${{ inputs.export-env }}
-        run: ./tests/assert-env-unset.sh
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -1,7 +1,4 @@
-on:
-  push:
-    branches: [main]
-  pull_request:
+on: pull_request
 name: Lint

 jobs:
@@ -14,16 +11,3 @@ jobs:
        with:
          ignore_paths: >-
            .husky
-      - name: Setup Node.js
-        id: setup-node
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: npm
-      - name: Install Dependencies
-        id: install
-        run: npm ci
-      - name: Check formatting
-        run: npm run format:check
-      - name: Check lint
-        run: npm run lint
--- a/.github/workflows/ok-to-test.yml
+++ b/.github/workflows/ok-to-test.yml
@@ -1,25 +0,0 @@
-# If someone with write access comments "/ok-to-test" on a pull request, emit a repository_dispatch event
-name: Ok To Test
-
-on:
-  issue_comment:
-    types: [created]
-
-jobs:
-  ok-to-test:
-    runs-on: ubuntu-latest
-    permissions:
-      pull-requests: write # For adding reactions to the pull request comments
-      contents: write # For executing the repository_dispatch event
-    # Only run for PRs, not issue comments
-    if: ${{ github.event.issue.pull_request }}
-    steps:
-      - name: Slash Command Dispatch
-        uses: peter-evans/slash-command-dispatch@v3
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          reaction-token: ${{ secrets.GITHUB_TOKEN }}
-          issue-type: pull-request
-          commands: ok-to-test
-          # The repository permission level required by the user to dispatch commands. Only allows 1Password collaborators to run this.
-          permission: write
--- a/.github/workflows/pr-check-signed-commits.yml
+++ b/.github/workflows/pr-check-signed-commits.yml
@@ -1,13 +0,0 @@
-name: Check signed commits in PR
-on: pull_request_target
-
-jobs:
-  build:
-    name: Check signed commits in PR
-    permissions:
-      contents: read
-      pull-requests: write
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check signed commits in PR
-        uses: 1Password/check-signed-commits-action@v1
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -0,0 +1,44 @@
+name: Release
+
+on:
+  push:
+    branches:
+      # TODO: This branch is for PR testing purposes; update branch to "main" if we proceed with this PR.
+      - ruetz-automate-releases
+  # Specify that this "Release" workflow depends on the other workflows below completing successfully.
+  workflow_run:
+    workflows: ["Lint", "Run acceptance tests"]
+    types:
+      - completed
+
+permissions:
+  contents: read # for checkout
+
+jobs:
+  release:
+    name: Release
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write # to be able to publish a GitHub release
+      issues: write # to be able to comment on released issues
+      pull-requests: write # to be able to comment on released pull requests
+      id-token: write # to enable use of OIDC for npm provenance
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "lts/*"
+      - name: Install dependencies
+        run: npm clean-install
+      - name: Verify the integrity of provenance attestations and registry signatures for installed dependencies
+        run: npm audit signatures
+      - name: Build codebase
+        run: npm run build
+      - name: Release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: npx semantic-release
--- a/.github/workflows/test-fork.yml
+++ b/.github/workflows/test-fork.yml
@@ -1,92 +0,0 @@
-on:
-  repository_dispatch:
-    types: [ok-to-test-command]
-name: Run acceptance tests [fork]
-
-jobs:
-  test-with-output-secrets:
-    if: |
-      github.event_name == 'repository_dispatch' &&
-      github.event.client_payload.slash_command.args.named.sha != '' &&
-      contains(
-        github.event.client_payload.pull_request.head.sha,
-        github.event.client_payload.slash_command.args.named.sha
-      )
-    uses: 1password/load-secrets-action/.github/workflows/acceptance-test.yml@main
-    secrets: inherit
-    with:
-      secret: op://acceptance-tests/test-secret/password
-      secret-in-section: op://acceptance-tests/test-secret/test-section/password
-      multiline-secret: op://acceptance-tests/multiline-secret/notesPlain
-      export-env: false
-  test-with-export-env:
-    if: |
-      github.event_name == 'repository_dispatch' &&
-      github.event.client_payload.slash_command.args.named.sha != '' &&
-      contains(
-        github.event.client_payload.pull_request.head.sha,
-        github.event.client_payload.slash_command.args.named.sha
-      )
-    uses: 1password/load-secrets-action/.github/workflows/acceptance-test.yml@main
-    secrets: inherit
-    with:
-      secret: op://acceptance-tests/test-secret/password
-      secret-in-section: op://acceptance-tests/test-secret/test-section/password
-      multiline-secret: op://acceptance-tests/multiline-secret/notesPlain
-      export-env: true
-  test-references-with-ids:
-    if: |
-      github.event_name == 'repository_dispatch' &&
-      github.event.client_payload.slash_command.args.named.sha != '' &&
-      contains(
-        github.event.client_payload.pull_request.head.sha,
-        github.event.client_payload.slash_command.args.named.sha
-      )
-    uses: 1password/load-secrets-action/.github/workflows/acceptance-test.yml@main
-    secrets: inherit
-    with:
-      secret: op://v5pz6venw4roosmkzdq2nhpv6u/hrgkzhrlvscomepxlgafb2m3ca/password
-      secret-in-section: op://v5pz6venw4roosmkzdq2nhpv6u/hrgkzhrlvscomepxlgafb2m3ca/Section_tco6nsqycj6jcbyx63h5isxcny/doxu3mhkozcznnk5vjrkpdqayy
-      multiline-secret: op://v5pz6venw4roosmkzdq2nhpv6u/ghtz3jvcc6dqmzc53d3r3eskge/notesPlain
-      export-env: false
-  update-checks:
-    # required permissions for updating the status of the pull request checks
-    permissions:
-      pull-requests: write
-      checks: write
-    runs-on: ubuntu-latest
-    if: ${{ always() }}
-    strategy:
-      matrix:
-        job-name:
-          [
-            test-with-output-secrets,
-            test-with-export-env,
-            test-references-with-ids,
-          ]
-    needs:
-      [test-with-output-secrets, test-with-export-env, test-references-with-ids]
-    steps:
-      - uses: actions/github-script@v6
-        env:
-          job: ${{ matrix.job-name }}
-          ref: ${{ github.event.client_payload.pull_request.head.sha }}
-          conclusion: ${{ needs[format('{0}', matrix.job-name )].result }}
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          script: |
-            const { data: checks } = await github.rest.checks.listForRef({
-              ...context.repo,
-              ref: process.env.ref
-            });
-
-            const check = checks.check_runs.filter(c => c.name === process.env.job);
-
-            const { data: result } = await github.rest.checks.update({
-              ...context.repo,
-              check_run_id: check[0].id,
-              status: 'completed',
-              conclusion: process.env.conclusion
-            });
-
-            return result;
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -1,7 +1,4 @@
-on:
-  push:
-    branches: [main]
-  pull_request:
+on: push
 name: Run acceptance tests

 jobs:
@@ -16,85 +13,134 @@ jobs:
      - run: npm test

  test-with-output-secrets:
-    if: |
-      github.ref == 'refs/heads/main' ||
-      (
-        github.event_name == 'pull_request' && 
-        github.event.pull_request.head.repo.full_name == github.repository
-      )
-    uses: 1password/load-secrets-action/.github/workflows/acceptance-test.yml@vzt/windows-support2 #TODO: after merge, this to main, revert to consume yml file from main (delete '@vzt/windows-support2')
-    secrets: inherit
    strategy:
      matrix:
-        os: [ ubuntu-latest, macos-latest, windows-latest ]
-        version: [ latest, latest-beta, 2.30.0, 2.30.0-beta.03 ]
-        auth: [ connect, service-account ]
+        os: [ubuntu-latest, macos-latest]
+        auth: [connect, service-account]
        exclude:
          - os: macos-latest
            auth: connect
-          - os: windows-latest
-            auth: connect
-    with:
-      os: ${{ matrix.os }}
-      version: ${{ matrix.version }}
-      auth: ${{ matrix.auth }}
-      secret: op://acceptance-tests/test-secret/password
-      secret-in-section: op://acceptance-tests/test-secret/test-section/password
-      multiline-secret: op://acceptance-tests/multiline-secret/notesPlain
-      export-env: false
-
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v3
+      - name: Launch 1Password Connect instance
+        if: ${{ matrix.auth == 'connect' }}
+        env:
+          OP_CONNECT_CREDENTIALS: ${{ secrets.OP_CONNECT_CREDENTIALS }}
+        run: |
+          echo "$OP_CONNECT_CREDENTIALS" > 1password-credentials.json
+          docker-compose -f tests/fixtures/docker-compose.yml up -d && sleep 10
+      - name: Configure Service account
+        if: ${{ matrix.auth == 'service-account' }}
+        uses: ./configure
+        with:
+          service-account-token: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
+      - name: Configure 1Password Connect
+        if: ${{ matrix.auth == 'connect' }}
+        uses: ./configure # 1password/load-secrets-action/configure@<version>
+        with:
+          connect-host: http://localhost:8080
+          connect-token: ${{ secrets.OP_CONNECT_TOKEN }}
+      - name: Load secrets
+        id: load_secrets
+        uses: ./ # 1password/load-secrets-action@<version>
+        with:
+          export-env: false
+        env:
+          SECRET: op://acceptance-tests/test-secret/password
+          SECRET_IN_SECTION: op://acceptance-tests/test-secret/test-section/password
+          MULTILINE_SECRET: op://acceptance-tests/multiline-secret/notesPlain
+      - name: Assert test secret values
+        env:
+          SECRET: ${{ steps.load_secrets.outputs.SECRET }}
+          SECRET_IN_SECTION: ${{ steps.load_secrets.outputs.SECRET_IN_SECTION }}
+          MULTILINE_SECRET: ${{ steps.load_secrets.outputs.MULTILINE_SECRET }}
+        run: ./tests/assert-env-set.sh
  test-with-export-env:
-    if: |
-      github.ref == 'refs/heads/main' ||
-      (
-        github.event_name == 'pull_request' && 
-        github.event.pull_request.head.repo.full_name == github.repository
-      )
-    uses: 1password/load-secrets-action/.github/workflows/acceptance-test.yml@vzt/windows-support2 #TODO: after merge, this to main, revert to consume yml file from main (delete '@vzt/windows-support2')
-    secrets: inherit
    strategy:
      matrix:
-        os: [ ubuntu-latest, macos-latest, windows-latest ]
-        version: [ latest, latest-beta, 2.30.0, 2.30.0-beta.03 ]
-        auth: [ connect, service-account ]
+        os: [ubuntu-latest, macos-latest]
+        auth: [connect, service-account]
        exclude:
          - os: macos-latest
            auth: connect
-          - os: windows-latest
-            auth: connect
-    with:
-      os: ${{ matrix.os }}
-      version: ${{ matrix.version }}
-      auth: ${{ matrix.auth }}
-      secret: op://acceptance-tests/test-secret/password
-      secret-in-section: op://acceptance-tests/test-secret/test-section/password
-      multiline-secret: op://acceptance-tests/multiline-secret/notesPlain
-      export-env: true
-
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v3
+      - name: Launch 1Password Connect instance
+        if: ${{ matrix.auth == 'connect' }}
+        env:
+          OP_CONNECT_CREDENTIALS: ${{ secrets.OP_CONNECT_CREDENTIALS }}
+        run: |
+          echo "$OP_CONNECT_CREDENTIALS" > 1password-credentials.json
+          docker-compose -f tests/fixtures/docker-compose.yml up -d && sleep 10
+      - name: Configure Service account
+        if: ${{ matrix.auth == 'service-account' }}
+        uses: ./configure
+        with:
+          service-account-token: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
+      - name: Configure 1Password Connect
+        if: ${{ matrix.auth == 'connect' }}
+        uses: ./configure # 1password/load-secrets-action/configure@<version>
+        with:
+          connect-host: http://localhost:8080
+          connect-token: ${{ secrets.OP_CONNECT_TOKEN }}
+      - name: Load secrets
+        id: load_secrets
+        uses: ./ # 1password/load-secrets-action@<version>
+        env:
+          SECRET: op://acceptance-tests/test-secret/password
+          SECRET_IN_SECTION: op://acceptance-tests/test-secret/test-section/password
+          MULTILINE_SECRET: op://acceptance-tests/multiline-secret/notesPlain
+      - name: Assert test secret values
+        run: ./tests/assert-env-set.sh
+      - name: Remove secrets
+        uses: ./ # 1password/load-secrets-action@<version>
+        with:
+          unset-previous: true
+      - name: Assert removed secrets
+        run: ./tests/assert-env-unset.sh
  test-references-with-ids:
-    if: |
-      github.ref == 'refs/heads/main' ||
-      (
-        github.event_name == 'pull_request' && 
-        github.event.pull_request.head.repo.full_name == github.repository
-      )
-    uses: 1password/load-secrets-action/.github/workflows/acceptance-test.yml@vzt/windows-support2 #TODO: after merge, this to main, revert to consume yml file from main (delete '@vzt/windows-support2')
-    secrets: inherit
    strategy:
      matrix:
-        os: [ ubuntu-latest, macos-latest, windows-latest ]
-        version: [ latest, latest-beta, 2.30.0, 2.30.0-beta.03 ]
-        auth: [ connect, service-account ]
+        os: [ubuntu-latest, macos-latest]
+        auth: [connect, service-account]
        exclude:
          - os: macos-latest
            auth: connect
-          - os: windows-latest
-            auth: connect
-    with:
-      os: ${{ matrix.os }}
-      version: ${{ matrix.version }}
-      auth: ${{ matrix.auth }}
-      secret: op://v5pz6venw4roosmkzdq2nhpv6u/hrgkzhrlvscomepxlgafb2m3ca/password
-      secret-in-section: op://v5pz6venw4roosmkzdq2nhpv6u/hrgkzhrlvscomepxlgafb2m3ca/Section_tco6nsqycj6jcbyx63h5isxcny/doxu3mhkozcznnk5vjrkpdqayy
-      multiline-secret: op://v5pz6venw4roosmkzdq2nhpv6u/ghtz3jvcc6dqmzc53d3r3eskge/notesPlain
-      export-env: false
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v3
+      - name: Launch 1Password Connect instance
+        if: ${{ matrix.auth == 'connect' }}
+        env:
+          OP_CONNECT_CREDENTIALS: ${{ secrets.OP_CONNECT_CREDENTIALS }}
+        run: |
+          echo "$OP_CONNECT_CREDENTIALS" > 1password-credentials.json
+          docker-compose -f tests/fixtures/docker-compose.yml up -d && sleep 10
+      - name: Configure Service account
+        if: ${{ matrix.auth == 'service-account' }}
+        uses: ./configure
+        with:
+          service-account-token: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
+      - name: Configure 1Password Connect
+        if: ${{ matrix.auth == 'connect' }}
+        uses: ./configure # 1password/load-secrets-action/configure@<version>
+        with:
+          connect-host: http://localhost:8080
+          connect-token: ${{ secrets.OP_CONNECT_TOKEN }}
+      - name: Load secrets
+        id: load_secrets
+        uses: ./ # 1password/load-secrets-action@<version>
+        with:
+          export-env: false
+        env:
+          SECRET: op://v5pz6venw4roosmkzdq2nhpv6u/hrgkzhrlvscomepxlgafb2m3ca/password
+          SECRET_IN_SECTION: op://v5pz6venw4roosmkzdq2nhpv6u/hrgkzhrlvscomepxlgafb2m3ca/Section_tco6nsqycj6jcbyx63h5isxcny/doxu3mhkozcznnk5vjrkpdqayy
+          MULTILINE_SECRET: op://v5pz6venw4roosmkzdq2nhpv6u/ghtz3jvcc6dqmzc53d3r3eskge/notesPlain
+      - name: Assert test secret values
+        env:
+          SECRET: ${{ steps.load_secrets.outputs.SECRET }}
+          SECRET_IN_SECTION: ${{ steps.load_secrets.outputs.SECRET_IN_SECTION }}
+          MULTILINE_SECRET: ${{ steps.load_secrets.outputs.MULTILINE_SECRET }}
+        run: ./tests/assert-env-set.sh
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -3,7 +3,6 @@
 Thank you for your interest in contributing to the 1Password load-secrets-action project 👋! Before you start, please take a moment to read through this guide to understand our contribution process.

 ## Testing
-
 Unit tests can be run with `npm run test`.

 After following the steps below for signing commits, you can test against your PR with these steps:
@@ -11,15 +10,13 @@ After following the steps below for signing commits, you can test against your P
 1. Create or use an existing repo to run the `load-secrets` GitHub Action.
 2. In a workflow yaml file that uses the GitHub Action, modify the `uses: 1Password/load-secrets-action` line to be

-   ```yaml
-   uses: 1Password/load-secrets-action@<branch-name>
-   ```
-
-   OR
-
-   ```yaml
-   uses: 1Password/load-secrets-action@<commit-hash>
-   ```
+    ```yaml
+    uses: 1Password/load-secrets-action@<branch-name>
+    ```
+    OR
+    ```yaml
+    uses: 1Password/load-secrets-action@<commit-hash>
+    ```

 3. Trigger the action, which now includes your changes.

@@ -51,4 +48,4 @@ Follow the steps below to set up commit signing with `gpg`:

 1. [Generate a GPG key](https://docs.github.com/en/authentication/managing-commit-signature-verification/generating-a-new-gpg-key)
 2. [Add the GPG key to your GitHub account](https://docs.github.com/en/authentication/managing-commit-signature-verification/adding-a-gpg-key-to-your-github-account)
-3. [Configure git to use your GPG key for commits signing](https://docs.github.com/en/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key#telling-git-about-your-gpg-key)
+3. [Configure git to use your GPG key for commits signing](https://docs.github.com/en/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key#telling-git-about-your-gpg-key)
--- a/README.md
+++ b/README.md
@@ -48,11 +48,13 @@ jobs:
 ## 💙 Community & Support

 - File an [issue](https://github.com/1Password/load-secrets-action/issues) for bugs and feature requests.
- Join the [Developer Slack workspace](https://developer.1password.com/joinslack).
+- Join the [Developer Slack workspace](https://join.slack.com/t/1password-devs/shared_invite/zt-1halo11ps-6o9pEv96xZ3LtX_VE0fJQA).
 - Subscribe to the [Developer Newsletter](https://1password.com/dev-subscribe/).

 ## 🔐 Security

 1Password requests you practice responsible disclosure if you discover a vulnerability.

-Please file requests by sending an email to bugbounty@agilebits.com.
+Please file requests via [**BugCrowd**](https://bugcrowd.com/agilebits).
+
+For information about security practices, please visit the [1Password Bug Bounty Program](https://bugcrowd.com/agilebits).
--- a/action.yml
+++ b/action.yml
@@ -5,9 +5,6 @@ branding:
  icon: lock
  color: blue
 inputs:
-  version:
-    description: Version of the 1Password CLI to install
-    default: latest
  unset-previous:
    description: Whether to unset environment variables populated by 1Password in earlier job steps
    default: "false"
--- a/config/jest.config.js
+++ b/config/jest.config.js
@@ -25,4 +25,4 @@ const jestConfig = {
 	verbose: true,
 };

-module.exports = jestConfig;
+export default jestConfig;
--- a/configure/action.yml
+++ b/configure/action.yml
@@ -9,5 +9,12 @@ inputs:
  service-account-token:
    description: Your 1Password service account token
 runs:
-  using: "node20"
-  main: "dist/index.js"
+  using: composite
+  steps:
+    - shell: bash
+      env:
+        INPUT_CONNECT_HOST: ${{ inputs.connect-host }}
+        INPUT_CONNECT_TOKEN: ${{ inputs.connect-token }}
+        INPUT_SERVICE_ACCOUNT_TOKEN: ${{ inputs.service-account-token }}
+      run: |
+        ${{ github.action_path }}/entrypoint.sh
--- a/configure/dist/index.js
+++ b/configure/dist/index.js
--- a/configure/entrypoint.sh
+++ b/configure/entrypoint.sh
@@ -0,0 +1,21 @@
+#!/bin/bash
+# shellcheck disable=SC2086
+set -e
+
+# Capture Connect configuration in $GITHUB_ENV, giving (optional) inputs 
+# precendence over OP_CONNECT_* environment variables.
+
+OP_CONNECT_HOST="${INPUT_CONNECT_HOST:-$OP_CONNECT_HOST}"
+if [ -n "$OP_CONNECT_HOST" ]; then
+  echo "OP_CONNECT_HOST=$OP_CONNECT_HOST" >> $GITHUB_ENV
+fi
+
+OP_CONNECT_TOKEN="${INPUT_CONNECT_TOKEN:-$OP_CONNECT_TOKEN}"
+if [ -n "$OP_CONNECT_TOKEN" ]; then
+  echo "OP_CONNECT_TOKEN=$OP_CONNECT_TOKEN" >> $GITHUB_ENV
+fi
+
+OP_SERVICE_ACCOUNT_TOKEN="${INPUT_SERVICE_ACCOUNT_TOKEN:-$OP_SERVICE_ACCOUNT_TOKEN}"
+if [ -n "$OP_SERVICE_ACCOUNT_TOKEN" ]; then
+  echo "OP_SERVICE_ACCOUNT_TOKEN=$OP_SERVICE_ACCOUNT_TOKEN" >> $GITHUB_ENV
+fi
--- a/configure/index.js
+++ b/configure/index.js
@@ -1,27 +0,0 @@
-const core = require("@actions/core");
-
-const configure = () => {
-	const OP_CONNECT_HOST =
-		core.getInput("connect-host", { required: false }) ||
-		process.env.OP_CONNECT_HOST;
-	const OP_CONNECT_TOKEN =
-		core.getInput("connect-token", { required: false }) ||
-		process.env.OP_CONNECT_TOKEN;
-	const OP_SERVICE_ACCOUNT_TOKEN =
-		core.getInput("service-account-token", { required: false }) ||
-		process.env.OP_SERVICE_ACCOUNT_TOKEN;
-
-	if (OP_CONNECT_HOST) {
-		core.exportVariable("OP_CONNECT_HOST", OP_CONNECT_HOST);
-	}
-
-	if (OP_CONNECT_TOKEN) {
-		core.exportVariable("OP_CONNECT_TOKEN", OP_CONNECT_TOKEN);
-	}
-
-	if (OP_SERVICE_ACCOUNT_TOKEN) {
-		core.exportVariable("OP_SERVICE_ACCOUNT_TOKEN", OP_SERVICE_ACCOUNT_TOKEN);
-	}
-};
-
-configure();
--- a/dist/index.js
+++ b/dist/index.js
--- a/dist/package.json
+++ b/dist/package.json
@@ -0,0 +1,3 @@
+{
+  "type": "module"
+}
--- a/package-lock.json
+++ b/package-lock.json
--- a/package.json
+++ b/package.json
@@ -2,13 +2,13 @@
 	"name": "load-secrets-action",
 	"version": "2.0.0",
 	"description": "Load Secrets from 1Password",
+	"type": "module",
 	"main": "dist/index.js",
 	"directories": {
 		"test": "tests"
 	},
 	"scripts": {
 		"build": "ncc build ./src/index.ts",
-		"build:configure": "ncc build ./configure/index.js -o ./configure/dist",
 		"format": "prettier --ignore-path ./config/.prettierignore",
 		"format:check": "npm run format -- --check ./",
 		"format:write": "npm run format -- --write ./",
@@ -24,7 +24,7 @@
 	},
 	"repository": {
 		"type": "git",
-		"url": "git+https://github.com/1Password/load-secrets-action.git"
+		"url": "git@github.com:1Password/load-secrets-action.git"
 	},
 	"keywords": [
 		"actions",
@@ -39,14 +39,12 @@
 	},
 	"homepage": "https://github.com/1Password/load-secrets-action#readme",
 	"dependencies": {
-		"@1password/op-js": "^0.1.14-alpha.5",
-		"@actions/core": "^1.11.1",
-		"@actions/exec": "^1.1.1",
-		"@actions/tool-cache": "^2.0.2"
+		"@1password/op-js": "^0.1.11",
+		"@actions/core": "^1.10.1",
+		"@actions/exec": "^1.1.1"
 	},
 	"devDependencies": {
-		"@1password/eslint-config": "^4.3.1",
-		"@1password/prettier-config": "^1.2.0",
+		"@1password/front-end-style": "^6.0.1",
 		"@types/jest": "^29.5.12",
 		"@types/node": "^20.11.30",
 		"@vercel/ncc": "^0.38.1",
@@ -57,7 +55,7 @@
 		"typescript": "^5.4.2"
 	},
 	"eslintConfig": {
-		"extends": "@1password/eslint-config",
+		"extends": "./node_modules/@1password/front-end-style/eslintrc.yml",
 		"ignorePatterns": [
 			"coverage/"
 		],
@@ -65,5 +63,5 @@
 			"project": "./tsconfig.json"
 		}
 	},
-	"prettier": "@1password/prettier-config"
+	"prettier": "./node_modules/@1password/front-end-style/prettierrc.json"
 }
--- a/release.config.cjs
+++ b/release.config.cjs
@@ -0,0 +1,15 @@
+/** @type {import('semantic-release').GlobalConfig} */
+module.exports = {
+	// TODO: This branch is for PR testing purposes; update branch to "main" if we proceed with this PR.
+	branches: ["ruetz-automate-releases"],
+	// TODO: Remove `dryRun` configuration if we proceed with this PR.
+	dryRun: true,
+	plugins: [
+		"@semantic-release/commit-analyzer",
+		"@semantic-release/release-notes-generator",
+		"@semantic-release/github",
+	],
+	// Use the `https` Git protocol here to prevent semantic-release from erroring
+	// on the SSH protocol used in `repository.url` in the package.json file.
+	repositoryUrl: "https://github.com/1Password/load-secrets-action.git",
+};
--- a/src/index.ts
+++ b/src/index.ts
@@ -1,5 +1,8 @@
+import path from "path";
+import url from "url";
 import * as core from "@actions/core";
-import { validateCli, installCliOnGithubRunner } from "@1password/op-js";
+import * as exec from "@actions/exec";
+import { validateCli } from "@1password/op-js";
 import { loadSecrets, unsetPrevious, validateAuth } from "./utils";

 const loadSecretsAction = async () => {
@@ -43,7 +46,21 @@ const installCLI = async (): Promise<void> => {
 	// If there's no CLI installed, then validateCli will throw an error, which we will use
 	// as an indicator that we need to execute the installation script.
 	await validateCli().catch(async () => {
-		await installCliOnGithubRunner();
+		const currentFile = url.fileURLToPath(import.meta.url);
+		const currentDir = path.dirname(currentFile);
+		const parentDir = path.resolve(currentDir, "..");
+
+		// Execute bash script
+		const cmdOut = await exec.getExecOutput(
+			`sh -c "` + parentDir + `/install_cli.sh"`,
+		);
+
+		// Add path to 1Password CLI to $PATH
+		const outArr = cmdOut.stdout.split("\n");
+		if (outArr[0] && process.env.PATH) {
+			const cliPath = outArr[0]?.replace(/^(::debug::OP_INSTALL_DIR: )/, "");
+			core.addPath(cliPath);
+		}
 	});
 };

--- a/src/utils.test.ts
+++ b/src/utils.test.ts
@@ -39,24 +39,24 @@ describe("validateAuth", () => {
 	});

 	it("should throw an error when no config is provided", () => {
-		expect(validateAuth).toThrow(authErr);
+		expect(validateAuth).toThrowError(authErr);
 	});

 	it("should throw an error when partial Connect config is provided", () => {
 		process.env[envConnectHost] = testConnectHost;
-		expect(validateAuth).toThrow(authErr);
+		expect(validateAuth).toThrowError(authErr);
 	});

 	it("should be authenticated as a Connect client", () => {
 		process.env[envConnectHost] = testConnectHost;
 		process.env[envConnectToken] = testConnectToken;
-		expect(validateAuth).not.toThrow(authErr);
+		expect(validateAuth).not.toThrowError(authErr);
 		expect(core.info).toHaveBeenCalledWith("Authenticated with Connect.");
 	});

 	it("should be authenticated as a service account", () => {
 		process.env[envServiceAccountToken] = testServiceAccountToken;
-		expect(validateAuth).not.toThrow(authErr);
+		expect(validateAuth).not.toThrowError(authErr);
 		expect(core.info).toHaveBeenCalledWith(
 			"Authenticated with Service account.",
 		);
@@ -66,7 +66,7 @@ describe("validateAuth", () => {
 		process.env[envServiceAccountToken] = testServiceAccountToken;
 		process.env[envConnectHost] = testConnectHost;
 		process.env[envConnectToken] = testConnectToken;
-		expect(validateAuth).not.toThrow(authErr);
+		expect(validateAuth).not.toThrowError(authErr);
 		expect(core.warning).toHaveBeenCalled();
 		expect(core.info).toHaveBeenCalledWith("Authenticated with Connect.");
 	});
--- a/tests/assert-cli-version.sh
+++ b/tests/assert-cli-version.sh
@@ -1,30 +0,0 @@
-#!/bin/bash
-set -e
-
-OP_CLI_VERSION="$1"
-CLI_URL="https://app-updates.agilebits.com/product_history/CLI2"
-
-get_latest_cli_version() {
-    conditional_path="/beta/"
-    if [ "$1" == "non_beta" ]; then
-        conditional_path="!/beta/"
-    fi
-    # This long command parses the HTML page at "CLI_URL" and finds the latest CLI version
-    # based on the release channel we're looking for (stable or beta).
-    #
-    # The ideal call (i.e. 'curl https://app-updates.agilebits.com/check/1/0/CLI2/en/2.0.0/Y -s | jq -r .version')
-    # doesn't retrieve the latest CLI version on a channel basis.
-    # If the latest release is stable and we want the latest beta, this command will return the stable still.
-    OP_CLI_VERSION="$(curl -s $CLI_URL | awk -v RS='<h3>|</h3>' 'NR % 2 == 0 {gsub(/[[:blank:]]+/, ""); gsub(/<span[^>]*>|<\/span>|[\r\n]+/, ""); gsub(/&nbsp;.*$/, ""); if (!'"$1"' && '"$conditional_path"'){print; '"$1"'=1;}}')"
-}
-
-if [ "$OP_CLI_VERSION" == "latest" ]; then
-    get_latest_cli_version non_beta
-elif [ "$OP_CLI_VERSION" == "latest-beta" ]; then
-    get_latest_cli_version beta
-fi
-
-if [ "$(op --version)" != "$OP_CLI_VERSION" ]; then
-    echo -e "Expected CLI version to be:\n$OP_CLI_VERSION\nBut got:\n$(op --version)"
-    exit 1
-fi
Author	SHA1	Message	Date
Dustin Ruetz	2722cfb5c8	feat(release.config.cjs): specify exported semantic-release object as GlobalConfig type Some checks failed Release / Release (push) Has been cancelled Details Run acceptance tests / unit-tests (push) Has been cancelled Details Run acceptance tests / test-with-output-secrets (connect, ubuntu-latest) (push) Has been cancelled Details Run acceptance tests / test-with-output-secrets (service-account, macos-latest) (push) Has been cancelled Details Run acceptance tests / test-with-output-secrets (service-account, ubuntu-latest) (push) Has been cancelled Details Run acceptance tests / test-with-export-env (connect, ubuntu-latest) (push) Has been cancelled Details Run acceptance tests / test-with-export-env (service-account, macos-latest) (push) Has been cancelled Details Run acceptance tests / test-with-export-env (service-account, ubuntu-latest) (push) Has been cancelled Details Run acceptance tests / test-references-with-ids (connect, ubuntu-latest) (push) Has been cancelled Details Run acceptance tests / test-references-with-ids (service-account, macos-latest) (push) Has been cancelled Details Run acceptance tests / test-references-with-ids (service-account, ubuntu-latest) (push) Has been cancelled Details	2024-04-04 21:17:49 -04:00
Dustin Ruetz	0b5bf555f1	fix: Git repo URL protocols (use SSH in package.json and HTTPS in release.config.cjs)	2024-04-04 21:16:10 -04:00
Dustin Ruetz	cca0f55ece	docs: clarify code comments	2024-04-04 21:14:15 -04:00
Dustin Ruetz	baa29d5bd0	feat(release.config.cjs): initial configuration file for semantic-release	2024-04-04 16:34:09 -04:00
Dustin Ruetz	7ffac7f68a	fix(package.json): switch 'repository.url' to HTTPS syntax	2024-04-04 16:28:41 -04:00
Dustin Ruetz	1b0b59a7a7	test: run release.yml workflow on push to this working branch	2024-04-03 18:36:21 -04:00
Dustin Ruetz	da98918135	test: run release.yml workflow on pull_request	2024-04-03 17:28:11 -04:00
Dustin Ruetz	e99f0139fe	feat(.github/workflows): testing initial Release workflow file	2024-04-03 17:23:56 -04:00
Dustin Ruetz	82b420f3b7	fix(package.json): switch 'repository.url' to SSH syntax	2024-04-03 17:22:55 -04:00