Merge pull request #110 from 1Password/vzt/prepare-release-v3

Prepare release v3.0.0

.github/workflows/acceptance-test.yml

@@ -96,8 +96,6 @@ jobs:
           SECRET: ${{ inputs.secret }}
           SECRET_IN_SECTION: ${{ inputs.secret-in-section }}
           MULTILINE_SECRET: ${{ inputs.multiline-secret }}
-      - name: Verify installed op cli version
-        run: ./tests/assert-cli-version.sh ${{ inputs.version }}
       - name: Assert test secret values [step output]
         if: ${{ !inputs.export-env }}
         env:

.github/workflows/test.yml

@@ -22,13 +22,13 @@ jobs:
         github.event_name == 'pull_request' && 
         github.event.pull_request.head.repo.full_name == github.repository
       )
-    uses: 1password/load-secrets-action/.github/workflows/acceptance-test.yml@vzt/windows-support2 #TODO: after merge, this to main, revert to consume yml file from main (delete '@vzt/windows-support2')
+    uses: 1password/load-secrets-action/.github/workflows/acceptance-test.yml@main
     secrets: inherit
     strategy:
       matrix:
-        os: [ ubuntu-latest, macos-latest, windows-latest ]
-        version: [ latest, latest-beta, 2.30.0, 2.30.0-beta.03 ]
-        auth: [ connect, service-account ]
+        os: [ubuntu-latest, macos-latest, windows-latest]
+        version: [latest, latest-beta, 2.30.0, 2.30.0-beta.03]
+        auth: [connect, service-account]
         exclude:
           - os: macos-latest
             auth: connect
@@ -50,13 +50,13 @@ jobs:
         github.event_name == 'pull_request' && 
         github.event.pull_request.head.repo.full_name == github.repository
       )
-    uses: 1password/load-secrets-action/.github/workflows/acceptance-test.yml@vzt/windows-support2 #TODO: after merge, this to main, revert to consume yml file from main (delete '@vzt/windows-support2')
+    uses: 1password/load-secrets-action/.github/workflows/acceptance-test.yml@main
     secrets: inherit
     strategy:
       matrix:
-        os: [ ubuntu-latest, macos-latest, windows-latest ]
-        version: [ latest, latest-beta, 2.30.0, 2.30.0-beta.03 ]
-        auth: [ connect, service-account ]
+        os: [ubuntu-latest, macos-latest, windows-latest]
+        version: [latest, latest-beta, 2.30.0, 2.30.0-beta.03]
+        auth: [connect, service-account]
         exclude:
           - os: macos-latest
             auth: connect
@@ -78,13 +78,13 @@ jobs:
         github.event_name == 'pull_request' && 
         github.event.pull_request.head.repo.full_name == github.repository
       )
-    uses: 1password/load-secrets-action/.github/workflows/acceptance-test.yml@vzt/windows-support2 #TODO: after merge, this to main, revert to consume yml file from main (delete '@vzt/windows-support2')
+    uses: 1password/load-secrets-action/.github/workflows/acceptance-test.yml@main
     secrets: inherit
     strategy:
       matrix:
-        os: [ ubuntu-latest, macos-latest, windows-latest ]
-        version: [ latest, latest-beta, 2.30.0, 2.30.0-beta.03 ]
-        auth: [ connect, service-account ]
+        os: [ubuntu-latest, macos-latest, windows-latest]
+        version: [latest, latest-beta, 2.30.0, 2.30.0-beta.03]
+        auth: [connect, service-account]
         exclude:
           - os: macos-latest
             auth: connect

README.md

@@ -23,16 +23,40 @@ Read more on the [1Password Developer Portal](https://developer.1password.com/do
 
 ## ✨ Quickstart
 
+### Export secrets as a step's output (recommended)
+
 ```yml
 on: push
 jobs:
   hello-world:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: Load secret
-        uses: 1password/load-secrets-action@v2
+        id: load_secret
+        uses: 1password/load-secrets-action@v3
+        env:
+          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
+          SECRET: op://app-cicd/hello-world/secret
+
+      - name: Print masked secret
+        run: 'echo "Secret: ${{ steps.load_secrets.outputs.SECRET }}"'
+        # Prints: Secret: ***
+```
+
+### Export secrets as env variables
+
+```yml
+on: push
+jobs:
+  hello-world:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Load secret
+        uses: 1password/load-secrets-action@v3
         with:
           # Export loaded secrets as environment variables
           export-env: true

action.yml

@@ -5,15 +5,15 @@ branding:
   icon: lock
   color: blue
 inputs:
-  version:
-    description: Version of the 1Password CLI to install
-    default: latest
   unset-previous:
     description: Whether to unset environment variables populated by 1Password in earlier job steps
     default: "false"
   export-env:
     description: Export the secrets as environment variables
-    default: "true"
+    default: "false"
+  version:
+    description: Specify which 1Password CLI version to install. Defaults to "latest".
+    default: "latest"
 runs:
   using: "node20"
   main: "dist/index.js"

config/jest.config.js

@@ -25,4 +25,4 @@ const jestConfig = {
 	verbose: true,
 };
 
-module.exports = jestConfig;
+export default jestConfig;

configure/dist/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "commonjs"
+}

dist/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "commonjs"
+}

install_cli.sh

@@ -1,46 +0,0 @@
-#!/bin/bash
-set -e
-
-# Install op-cli
-install_op_cli() {
-  # Create a temporary directory where the CLI is installed
-  OP_INSTALL_DIR="$(mktemp -d)"
-  if [[ ! -d "$OP_INSTALL_DIR" ]]; then
-    echo "Install dir $OP_INSTALL_DIR not found"
-    exit 1
-  fi
-  echo "::debug::OP_INSTALL_DIR: ${OP_INSTALL_DIR}"
-
-  # Get the latest stable version of the CLI
-  CLI_VERSION="v$(curl https://app-updates.agilebits.com/check/1/0/CLI2/en/2.0.0/N -s | grep -Eo '[0-9]+\.[0-9]+\.[0-9]+')"
-
-  if [[ "$OSTYPE" == "linux-gnu"* ]]; then
-    # Get runner's architecture
-    ARCH=$(uname -m)
-    if [[ "$(getconf LONG_BIT)" = 32 ]]; then
-      ARCH="386"
-    elif [[ "$ARCH" == "x86_64" ]]; then
-      ARCH="amd64"
-    elif [[ "$ARCH" == "aarch64" ]]; then
-      ARCH="arm64"
-    fi
-
-    if [[ "$ARCH" != "386" ]] && [[ "$ARCH" != "amd64" ]] && [[ "$ARCH" != "arm" ]] && [[ "$ARCH" != "arm64" ]]; then
-      echo "Unsupported architecture for the 1Password CLI: $ARCH."
-      exit 1
-    fi
-
-    curl -sSfLo op.zip "https://cache.agilebits.com/dist/1P/op2/pkg/${CLI_VERSION}/op_linux_${ARCH}_${CLI_VERSION}.zip"
-    unzip -od "$OP_INSTALL_DIR" op.zip && rm op.zip
-  elif [[ "$OSTYPE" == "darwin"* ]]; then
-    curl -sSfLo op.pkg "https://cache.agilebits.com/dist/1P/op2/pkg/${CLI_VERSION}/op_apple_universal_${CLI_VERSION}.pkg"
-    pkgutil --expand op.pkg temp-pkg
-    tar -xvf temp-pkg/op.pkg/Payload -C "$OP_INSTALL_DIR"
-    rm -rf temp-pkg && rm op.pkg
-  else
-    echo "Operating system not supported yet for this GitHub Action: $OSTYPE."
-    exit 1
-  fi
-}
-
-install_op_cli

package-lock.json

@@ -1,18 +1,18 @@
 {
 	"name": "load-secrets-action",
-	"version": "2.0.0",
+	"version": "3.0.0",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "load-secrets-action",
-			"version": "2.0.0",
+			"version": "3.0.0",
 			"license": "MIT",
 			"dependencies": {
-				"@1password/op-js": "^0.1.14-alpha.5",
-				"@actions/core": "^1.11.1",
+				"@1password/op-js": "^0.1.11",
+				"@actions/core": "^1.10.1",
 				"@actions/exec": "^1.1.1",
-				"@actions/tool-cache": "^2.0.2"
+				"op-cli-installer": "github:1Password/op-cli-installer#e6c1c758bc3339e5fe9b06255728039f688f73fa"
 			},
 			"devDependencies": {
 				"@1password/eslint-config": "^4.3.1",
@@ -27,38 +27,6 @@
 				"typescript": "^5.4.2"
 			}
 		},
-		"../op-js": {
-			"name": "@1password/op-js",
-			"version": "0.1.14-alpha.1",
-			"extraneous": true,
-			"license": "MIT",
-			"dependencies": {
-				"@actions/core": "^1.11.1",
-				"@actions/tool-cache": "^2.0.2",
-				"lookpath": "^1.2.2",
-				"semver": "^7.6.2"
-			},
-			"devDependencies": {
-				"@1password/eslint-config": "^4.3.0",
-				"@1password/prettier-config": "^1.1.3",
-				"@types/jest": "^29.5.12",
-				"@types/node": "^20.12.12",
-				"@types/semver": "^7.5.8",
-				"@typescript-eslint/eslint-plugin": "^7.9.0",
-				"esbuild": "^0.21.2",
-				"eslint": "^8.57.0",
-				"husky": "^9.0.11",
-				"jest": "^29.7.0",
-				"jest-environment-jsdom": "^29.6.2",
-				"joi": "^17.13.1",
-				"license-checker-rseidelsohn": "^4.3.0",
-				"lint-staged": "^15.2.2",
-				"prettier": "^3.2.5",
-				"prettier-plugin-organize-imports": "^3.2.4",
-				"ts-jest": "^29.1.2",
-				"typescript": "5.4.5"
-			}
-		},
 		"node_modules/@1password/eslint-config": {
 			"version": "4.3.1",
 			"resolved": "https://registry.npmjs.org/@1password/eslint-config/-/eslint-config-4.3.1.tgz",
@@ -84,12 +52,11 @@
 			}
 		},
 		"node_modules/@1password/op-js": {
-			"version": "0.1.14-alpha.5",
-			"resolved": "https://registry.npmjs.org/@1password/op-js/-/op-js-0.1.14-alpha.5.tgz",
-			"integrity": "sha512-G+psqF+8CEGAfUzHIk1Y8m6F8y6UAyyYk2pT8078hmvoKDmpEUZXCvA2X0QrVfZhTllvRPuKVI+GbCgy8l74Yw==",
+			"version": "0.1.13",
+			"resolved": "https://registry.npmjs.org/@1password/op-js/-/op-js-0.1.13.tgz",
+			"integrity": "sha512-ZZBLxVqywFdvIbLv2xWw2N1ImSi183rRKf90vV19KRMReNyLwuD0dv6IrKrIdrJU33IuV3Gz85Z4K2a1PJTBDg==",
+			"license": "MIT",
 			"dependencies": {
-				"@actions/core": "^1.11.1",
-				"@actions/tool-cache": "^2.0.2",
 				"lookpath": "^1.2.2",
 				"semver": "^7.6.2"
 			}
@@ -1695,10 +1662,11 @@
 			}
 		},
 		"node_modules/acorn": {
-			"version": "8.15.0",
-			"resolved": "https://registry.npmjs.org/acorn/-/acorn-8.15.0.tgz",
-			"integrity": "sha512-NZyJarBfL7nWwIq+FDL6Zp/yHEhePMNnnJ0y3qfieCrmNvYct8uvtiV41UvlSe6apAfk0fY1FbWx+NwfmpvtTg==",
+			"version": "8.14.0",
+			"resolved": "https://registry.npmjs.org/acorn/-/acorn-8.14.0.tgz",
+			"integrity": "sha512-cl669nCJTZBsL97OF4kUQm5g5hC2uihk0NxY3WENAC0TYdILVkAyHymAntgxGkl7K+t0cXIrH5siy5S4XkFycA==",
 			"dev": true,
+			"license": "MIT",
 			"peer": true,
 			"bin": {
 				"acorn": "bin/acorn"
@@ -6083,9 +6051,10 @@
 			}
 		},
 		"node_modules/lookpath": {
-			"version": "1.2.3",
-			"resolved": "https://registry.npmjs.org/lookpath/-/lookpath-1.2.3.tgz",
-			"integrity": "sha512-kthRVhf4kH4+HW3anM4UBHxsw/XFESf13euCEldhXr6GpBdmBoa7rDd7WO5G0Mhd4G5XtKTcEy8OR0iRZXpS3Q==",
+			"version": "1.2.2",
+			"resolved": "https://registry.npmjs.org/lookpath/-/lookpath-1.2.2.tgz",
+			"integrity": "sha512-k2Gmn8iV6qdME3ztZC2spubmQISimFOPLuQKiPaLcVdRz0IpdxrNClVepMlyTJlhodm/zG/VfbkWERm3kUIh+Q==",
+			"license": "MIT",
 			"bin": {
 				"lookpath": "bin/lookpath.js"
 			},
@@ -6417,6 +6386,28 @@
 				"url": "https://github.com/sponsors/sindresorhus"
 			}
 		},
+		"node_modules/op-cli-installer": {
+			"version": "1.0.0",
+			"resolved": "git+ssh://git@github.com/1Password/op-cli-installer.git#e6c1c758bc3339e5fe9b06255728039f688f73fa",
+			"integrity": "sha512-ueyYQAgtbIHP2QWx9iCiztoPov01GdxPZNZ4+Qg3IaAyC4khMIk4/vYPagRhRKta+HI6fWV6jO3/ajBj27KBZA==",
+			"license": "MIT",
+			"dependencies": {
+				"@actions/core": "^1.11.1",
+				"@actions/tool-cache": "^2.0.2",
+				"semver": "^7.7.2"
+			}
+		},
+		"node_modules/op-cli-installer/node_modules/semver": {
+			"version": "7.7.2",
+			"resolved": "https://registry.npmjs.org/semver/-/semver-7.7.2.tgz",
+			"integrity": "sha512-RF0Fw+rO5AMf9MAyaRXI4AV0Ulj5lMHqVxxdSgiVbixSCXoEmmX/jk0CuJw4+3SqroYO9VoUh+HcuJivvtJemA==",
+			"bin": {
+				"semver": "bin/semver.js"
+			},
+			"engines": {
+				"node": ">=10"
+			}
+		},
 		"node_modules/optionator": {
 			"version": "0.9.4",
 			"resolved": "https://registry.npmjs.org/optionator/-/optionator-0.9.4.tgz",
@@ -7041,9 +7032,10 @@
 			}
 		},
 		"node_modules/semver": {
-			"version": "7.7.2",
-			"resolved": "https://registry.npmjs.org/semver/-/semver-7.7.2.tgz",
-			"integrity": "sha512-RF0Fw+rO5AMf9MAyaRXI4AV0Ulj5lMHqVxxdSgiVbixSCXoEmmX/jk0CuJw4+3SqroYO9VoUh+HcuJivvtJemA==",
+			"version": "7.6.3",
+			"resolved": "https://registry.npmjs.org/semver/-/semver-7.6.3.tgz",
+			"integrity": "sha512-oVekP1cKtI+CTDvHWYFUcMtsK/00wmAEfyqKfNdARm8u1wNVhSgaX7A8d4UuIlUI5e84iEwOhs7ZPYRmzU9U6A==",
+			"license": "ISC",
 			"bin": {
 				"semver": "bin/semver.js"
 			},

package.json

@@ -1,6 +1,6 @@
 {
 	"name": "load-secrets-action",
-	"version": "2.0.0",
+	"version": "3.0.0",
 	"description": "Load Secrets from 1Password",
 	"main": "dist/index.js",
 	"directories": {
@@ -9,6 +9,7 @@
 	"scripts": {
 		"build": "ncc build ./src/index.ts",
 		"build:configure": "ncc build ./configure/index.js -o ./configure/dist",
+		"build:all": "npm run build && npm run build:configure",
 		"format": "prettier --ignore-path ./config/.prettierignore",
 		"format:check": "npm run format -- --check ./",
 		"format:write": "npm run format -- --write ./",
@@ -39,10 +40,10 @@
 	},
 	"homepage": "https://github.com/1Password/load-secrets-action#readme",
 	"dependencies": {
-		"@1password/op-js": "^0.1.14-alpha.5",
-		"@actions/core": "^1.11.1",
+		"@1password/op-js": "^0.1.11",
+		"@actions/core": "^1.10.1",
 		"@actions/exec": "^1.1.1",
-		"@actions/tool-cache": "^2.0.2"
+		"op-cli-installer": "github:1Password/op-cli-installer#e6c1c758bc3339e5fe9b06255728039f688f73fa"
 	},
 	"devDependencies": {
 		"@1password/eslint-config": "^4.3.1",

src/index.ts

@@ -1,5 +1,6 @@
 import * as core from "@actions/core";
-import { validateCli, installCliOnGithubRunner } from "@1password/op-js";
+import { validateCli } from "@1password/op-js";
+import { installCliOnGithubActionRunner } from "op-cli-installer";
 import { loadSecrets, unsetPrevious, validateAuth } from "./utils";
 
 const loadSecretsAction = async () => {
@@ -43,7 +44,7 @@ const installCLI = async (): Promise<void> => {
 	// If there's no CLI installed, then validateCli will throw an error, which we will use
 	// as an indicator that we need to execute the installation script.
 	await validateCli().catch(async () => {
-		await installCliOnGithubRunner();
+		await installCliOnGithubActionRunner();
 	});
 };
 

tests/assert-cli-version.sh

@@ -1,30 +0,0 @@
-#!/bin/bash
-set -e
-
-OP_CLI_VERSION="$1"
-CLI_URL="https://app-updates.agilebits.com/product_history/CLI2"
-
-get_latest_cli_version() {
-    conditional_path="/beta/"
-    if [ "$1" == "non_beta" ]; then
-        conditional_path="!/beta/"
-    fi
-    # This long command parses the HTML page at "CLI_URL" and finds the latest CLI version
-    # based on the release channel we're looking for (stable or beta).
-    #
-    # The ideal call (i.e. 'curl https://app-updates.agilebits.com/check/1/0/CLI2/en/2.0.0/Y -s | jq -r .version')
-    # doesn't retrieve the latest CLI version on a channel basis.
-    # If the latest release is stable and we want the latest beta, this command will return the stable still.
-    OP_CLI_VERSION="$(curl -s $CLI_URL | awk -v RS='<h3>|</h3>' 'NR % 2 == 0 {gsub(/[[:blank:]]+/, ""); gsub(/<span[^>]*>|<\/span>|[\r\n]+/, ""); gsub(/&nbsp;.*$/, ""); if (!'"$1"' && '"$conditional_path"'){print; '"$1"'=1;}}')"
-}
-
-if [ "$OP_CLI_VERSION" == "latest" ]; then
-    get_latest_cli_version non_beta
-elif [ "$OP_CLI_VERSION" == "latest-beta" ]; then
-    get_latest_cli_version beta
-fi
-
-if [ "$(op --version)" != "$OP_CLI_VERSION" ]; then
-    echo -e "Expected CLI version to be:\n$OP_CLI_VERSION\nBut got:\n$(op --version)"
-    exit 1
-fi