Added basic usage examples to readme

Update readme to link to developer portal
This MR updates the readme to: - Match the final edited text used in the developer portal - Link out to the developer portal for usage examples beyond basic setup
2022-10-18 09:03:48 -04:00 · 2022-10-03 09:26:54 -04:00
30 changed files with 811 additions and 98026 deletions
--- a/.github/workflows/acceptance-test.yml
+++ b/.github/workflows/acceptance-test.yml
@@ -1,118 +0,0 @@
-name: Acceptance test
-
-on:
-  workflow_call:
-    inputs:
-      secret:
-        required: true
-        type: string
-      secret-in-section:
-        required: true
-        type: string
-      multiline-secret:
-        required: true
-        type: string
-      export-env:
-        required: true
-        type: boolean
-      version:
-        required: false
-        type: string
-        default: "latest"
-      os:
-        required: true
-        type: string
-        default: "ubuntu-latest"
-      auth:
-        required: true
-        type: string
-
-jobs:
-  acceptance-test:
-    runs-on: ${{ inputs.os }}
-    steps:
-      - name: Base checkout
-        uses: actions/checkout@v4
-        if: |
-          github.event_name != 'repository_dispatch' &&
-          (
-            github.ref == 'refs/heads/main' || 
-            (
-              github.event_name == 'pull_request' && 
-              github.event.pull_request.head.repo.full_name == github.repository
-            )
-          )
-      - name: Fork based /ok-to-test checkout
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.client_payload.pull_request.head.sha }}
-        if: |
-          github.event_name == 'repository_dispatch' &&
-          github.event.client_payload.slash_command.args.named.sha != '' &&
-          contains(
-            github.event.client_payload.pull_request.head.sha,
-            github.event.client_payload.slash_command.args.named.sha
-          )
-      - name: Launch 1Password Connect instance
-        if: ${{ inputs.auth == 'connect' }}
-        env:
-          OP_CONNECT_CREDENTIALS: ${{ secrets.OP_CONNECT_CREDENTIALS }}
-        run: |
-          echo "$OP_CONNECT_CREDENTIALS" > 1password-credentials.json
-          docker compose -f tests/fixtures/docker-compose.yml up -d && sleep 10
-      - name: Configure Service account
-        if: ${{ inputs.auth == 'service-account' }}
-        uses: ./configure
-        with:
-          service-account-token: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
-      - name: Verify Service Account env var is set
-        if: ${{ inputs.auth == 'service-account' }}
-        shell: bash
-        run: |
-          if [ -z "${OP_SERVICE_ACCOUNT_TOKEN}" ]; then
-            echo "OP_SERVICE_ACCOUNT_TOKEN environment variable is not set" >&2
-            exit 1
-          fi
-      - name: Configure 1Password Connect
-        if: ${{ inputs.auth == 'connect' }}
-        uses: ./configure # 1password/load-secrets-action/configure@<version>
-        with:
-          connect-host: http://localhost:8080
-          connect-token: ${{ secrets.OP_CONNECT_TOKEN }}
-      - name: Verify Connect env vars are set
-        if: ${{ inputs.auth == 'connect' }}
-        run: |
-          if [ -z "$OP_CONNECT_HOST" ] || [ -z "$OP_CONNECT_TOKEN" ]; then
-            echo "OP_CONNECT_HOST or OP_CONNECT_TOKEN environment variables are not set" >&2
-            exit 1
-          fi
-      - name: Load secrets
-        id: load_secrets
-        uses: ./ # 1password/load-secrets-action@<version>
-        with:
-          version: ${{ inputs.version }}
-          export-env: ${{ inputs.export-env }}
-        env:
-          SECRET: ${{ inputs.secret }}
-          SECRET_IN_SECTION: ${{ inputs.secret-in-section }}
-          MULTILINE_SECRET: ${{ inputs.multiline-secret }}
-      - name: Verify installed op cli version
-        run: ./tests/assert-cli-version.sh ${{ inputs.version }}
-      - name: Assert test secret values [step output]
-        if: ${{ !inputs.export-env }}
-        env:
-          SECRET: ${{ steps.load_secrets.outputs.SECRET }}
-          SECRET_IN_SECTION: ${{ steps.load_secrets.outputs.SECRET_IN_SECTION }}
-          MULTILINE_SECRET: ${{ steps.load_secrets.outputs.MULTILINE_SECRET }}
-        run: ./tests/assert-env-set.sh
-      - name: Assert test secret values [exported env]
-        if: ${{ inputs.export-env }}
-        run: ./tests/assert-env-set.sh
-      - name: Remove secrets [exported env]
-        if: ${{ inputs.export-env }}
-        uses: ./ # 1password/load-secrets-action@<version>
-        with:
-          unset-previous: true
-      - name: Assert removed secrets [exported env]
-        if: ${{ inputs.export-env }}
-        run: ./tests/assert-env-unset.sh
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -1,29 +1,10 @@
-on:
-  push:
-    branches: [main]
-  pull_request:
+on: pull_request
 name: Lint

 jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v3
-      - name: Run ShellCheck
-        uses: ludeeus/action-shellcheck@2.0.0
-        with:
-          ignore_paths: >-
-            .husky
-      - name: Setup Node.js
-        id: setup-node
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: npm
-      - name: Install Dependencies
-        id: install
-        run: npm ci
-      - name: Check formatting
-        run: npm run format:check
-      - name: Check lint
-        run: npm run lint
+      - uses: actions/checkout@v2
+      - name: ShellCheck
+        uses: ludeeus/action-shellcheck@1.1.0
--- a/.github/workflows/ok-to-test.yml
+++ b/.github/workflows/ok-to-test.yml
@@ -1,25 +0,0 @@
-# If someone with write access comments "/ok-to-test" on a pull request, emit a repository_dispatch event
-name: Ok To Test
-
-on:
-  issue_comment:
-    types: [created]
-
-jobs:
-  ok-to-test:
-    runs-on: ubuntu-latest
-    permissions:
-      pull-requests: write # For adding reactions to the pull request comments
-      contents: write # For executing the repository_dispatch event
-    # Only run for PRs, not issue comments
-    if: ${{ github.event.issue.pull_request }}
-    steps:
-      - name: Slash Command Dispatch
-        uses: peter-evans/slash-command-dispatch@v3
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          reaction-token: ${{ secrets.GITHUB_TOKEN }}
-          issue-type: pull-request
-          commands: ok-to-test
-          # The repository permission level required by the user to dispatch commands. Only allows 1Password collaborators to run this.
-          permission: write
--- a/.github/workflows/pr-check-signed-commits.yml
+++ b/.github/workflows/pr-check-signed-commits.yml
@@ -1,13 +0,0 @@
-name: Check signed commits in PR
-on: pull_request_target
-
-jobs:
-  build:
-    name: Check signed commits in PR
-    permissions:
-      contents: read
-      pull-requests: write
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check signed commits in PR
-        uses: 1Password/check-signed-commits-action@v1
--- a/.github/workflows/test-fork.yml
+++ b/.github/workflows/test-fork.yml
@@ -1,92 +0,0 @@
-on:
-  repository_dispatch:
-    types: [ok-to-test-command]
-name: Run acceptance tests [fork]
-
-jobs:
-  test-with-output-secrets:
-    if: |
-      github.event_name == 'repository_dispatch' &&
-      github.event.client_payload.slash_command.args.named.sha != '' &&
-      contains(
-        github.event.client_payload.pull_request.head.sha,
-        github.event.client_payload.slash_command.args.named.sha
-      )
-    uses: 1password/load-secrets-action/.github/workflows/acceptance-test.yml@main
-    secrets: inherit
-    with:
-      secret: op://acceptance-tests/test-secret/password
-      secret-in-section: op://acceptance-tests/test-secret/test-section/password
-      multiline-secret: op://acceptance-tests/multiline-secret/notesPlain
-      export-env: false
-  test-with-export-env:
-    if: |
-      github.event_name == 'repository_dispatch' &&
-      github.event.client_payload.slash_command.args.named.sha != '' &&
-      contains(
-        github.event.client_payload.pull_request.head.sha,
-        github.event.client_payload.slash_command.args.named.sha
-      )
-    uses: 1password/load-secrets-action/.github/workflows/acceptance-test.yml@main
-    secrets: inherit
-    with:
-      secret: op://acceptance-tests/test-secret/password
-      secret-in-section: op://acceptance-tests/test-secret/test-section/password
-      multiline-secret: op://acceptance-tests/multiline-secret/notesPlain
-      export-env: true
-  test-references-with-ids:
-    if: |
-      github.event_name == 'repository_dispatch' &&
-      github.event.client_payload.slash_command.args.named.sha != '' &&
-      contains(
-        github.event.client_payload.pull_request.head.sha,
-        github.event.client_payload.slash_command.args.named.sha
-      )
-    uses: 1password/load-secrets-action/.github/workflows/acceptance-test.yml@main
-    secrets: inherit
-    with:
-      secret: op://v5pz6venw4roosmkzdq2nhpv6u/hrgkzhrlvscomepxlgafb2m3ca/password
-      secret-in-section: op://v5pz6venw4roosmkzdq2nhpv6u/hrgkzhrlvscomepxlgafb2m3ca/Section_tco6nsqycj6jcbyx63h5isxcny/doxu3mhkozcznnk5vjrkpdqayy
-      multiline-secret: op://v5pz6venw4roosmkzdq2nhpv6u/ghtz3jvcc6dqmzc53d3r3eskge/notesPlain
-      export-env: false
-  update-checks:
-    # required permissions for updating the status of the pull request checks
-    permissions:
-      pull-requests: write
-      checks: write
-    runs-on: ubuntu-latest
-    if: ${{ always() }}
-    strategy:
-      matrix:
-        job-name:
-          [
-            test-with-output-secrets,
-            test-with-export-env,
-            test-references-with-ids,
-          ]
-    needs:
-      [test-with-output-secrets, test-with-export-env, test-references-with-ids]
-    steps:
-      - uses: actions/github-script@v6
-        env:
-          job: ${{ matrix.job-name }}
-          ref: ${{ github.event.client_payload.pull_request.head.sha }}
-          conclusion: ${{ needs[format('{0}', matrix.job-name )].result }}
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          script: |
-            const { data: checks } = await github.rest.checks.listForRef({
-              ...context.repo,
-              ref: process.env.ref
-            });
-
-            const check = checks.check_runs.filter(c => c.name === process.env.job);
-
-            const { data: result } = await github.rest.checks.update({
-              ...context.repo,
-              check_run_id: check[0].id,
-              status: 'completed',
-              conclusion: process.env.conclusion
-            });
-
-            return result;
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -1,100 +1,162 @@
-on:
-  push:
-    branches: [main]
-  pull_request:
+on: push
 name: Run acceptance tests

 jobs:
-  unit-tests:
+  use-connect-without-export-env:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3
+      - uses: actions/checkout@v2
+      - name: Launch 1Password Connect instance
+        env:
+          OP_CONNECT_CREDENTIALS: ${{ secrets.OP_CONNECT_CREDENTIALS }}
+        run: |
+          echo "$OP_CONNECT_CREDENTIALS" > 1password-credentials.json
+          docker-compose -f tests/fixtures/docker-compose.yml up -d && sleep 10
+      - name: Configure 1Password Connect
+        uses: ./configure # 1password/load-secrets-action/configure@<version>
        with:
-          node-version: 20
-      - run: npm ci
-      - run: npm test
-
-  test-with-output-secrets:
-    if: |
-      github.ref == 'refs/heads/main' ||
-      (
-        github.event_name == 'pull_request' && 
-        github.event.pull_request.head.repo.full_name == github.repository
-      )
-    uses: 1password/load-secrets-action/.github/workflows/acceptance-test.yml@vzt/windows-support2 #TODO: after merge, this to main, revert to consume yml file from main (delete '@vzt/windows-support2')
-    secrets: inherit
-    strategy:
-      matrix:
-        os: [ ubuntu-latest, macos-latest, windows-latest ]
-        version: [ latest, latest-beta, 2.30.0, 2.30.0-beta.03 ]
-        auth: [ connect, service-account ]
-        exclude:
-          - os: macos-latest
-            auth: connect
-          - os: windows-latest
-            auth: connect
-    with:
-      os: ${{ matrix.os }}
-      version: ${{ matrix.version }}
-      auth: ${{ matrix.auth }}
-      secret: op://acceptance-tests/test-secret/password
-      secret-in-section: op://acceptance-tests/test-secret/test-section/password
-      multiline-secret: op://acceptance-tests/multiline-secret/notesPlain
-      export-env: false
-
-  test-with-export-env:
-    if: |
-      github.ref == 'refs/heads/main' ||
-      (
-        github.event_name == 'pull_request' && 
-        github.event.pull_request.head.repo.full_name == github.repository
-      )
-    uses: 1password/load-secrets-action/.github/workflows/acceptance-test.yml@vzt/windows-support2 #TODO: after merge, this to main, revert to consume yml file from main (delete '@vzt/windows-support2')
-    secrets: inherit
-    strategy:
-      matrix:
-        os: [ ubuntu-latest, macos-latest, windows-latest ]
-        version: [ latest, latest-beta, 2.30.0, 2.30.0-beta.03 ]
-        auth: [ connect, service-account ]
-        exclude:
-          - os: macos-latest
-            auth: connect
-          - os: windows-latest
-            auth: connect
-    with:
-      os: ${{ matrix.os }}
-      version: ${{ matrix.version }}
-      auth: ${{ matrix.auth }}
-      secret: op://acceptance-tests/test-secret/password
-      secret-in-section: op://acceptance-tests/test-secret/test-section/password
-      multiline-secret: op://acceptance-tests/multiline-secret/notesPlain
-      export-env: true
-
-  test-references-with-ids:
-    if: |
-      github.ref == 'refs/heads/main' ||
-      (
-        github.event_name == 'pull_request' && 
-        github.event.pull_request.head.repo.full_name == github.repository
-      )
-    uses: 1password/load-secrets-action/.github/workflows/acceptance-test.yml@vzt/windows-support2 #TODO: after merge, this to main, revert to consume yml file from main (delete '@vzt/windows-support2')
-    secrets: inherit
-    strategy:
-      matrix:
-        os: [ ubuntu-latest, macos-latest, windows-latest ]
-        version: [ latest, latest-beta, 2.30.0, 2.30.0-beta.03 ]
-        auth: [ connect, service-account ]
-        exclude:
-          - os: macos-latest
-            auth: connect
-          - os: windows-latest
-            auth: connect
-    with:
-      os: ${{ matrix.os }}
-      version: ${{ matrix.version }}
-      auth: ${{ matrix.auth }}
-      secret: op://v5pz6venw4roosmkzdq2nhpv6u/hrgkzhrlvscomepxlgafb2m3ca/password
-      secret-in-section: op://v5pz6venw4roosmkzdq2nhpv6u/hrgkzhrlvscomepxlgafb2m3ca/Section_tco6nsqycj6jcbyx63h5isxcny/doxu3mhkozcznnk5vjrkpdqayy
-      multiline-secret: op://v5pz6venw4roosmkzdq2nhpv6u/ghtz3jvcc6dqmzc53d3r3eskge/notesPlain
-      export-env: false
+          connect-host: http://localhost:8080
+          connect-token: ${{ secrets.OP_CONNECT_TOKEN }}
+      - name: Load secrets
+        id: load_secrets
+        uses: ./ # 1password/load-secrets-action@<version>
+        env:
+          SECRET: op://acceptance-tests/test-secret/password
+          SECRET_IN_SECTION: op://acceptance-tests/test-secret/test-section/password
+          MULTILINE_SECRET: op://acceptance-tests/multiline-secret/notesPlain
+      - name: Assert test secret values
+        env:
+          SECRET: ${{ steps.load_secrets.outputs.SECRET }}
+          SECRET_IN_SECTION: ${{ steps.load_secrets.outputs.SECRET_IN_SECTION }}
+          MULTILINE_SECRET: ${{ steps.load_secrets.outputs.MULTILINE_SECRET }}
+        run: ./tests/assert-env-set.sh
+  use-connect-with-export-env:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - name: Launch 1Password Connect instance
+        env:
+          OP_CONNECT_CREDENTIALS: ${{ secrets.OP_CONNECT_CREDENTIALS }}
+        run: |
+          echo "$OP_CONNECT_CREDENTIALS" > 1password-credentials.json
+          docker-compose -f tests/fixtures/docker-compose.yml up -d && sleep 10
+      - name: Configure 1Password Connect
+        uses: ./configure # 1password/load-secrets-action/configure@<version>
+        with:
+          connect-host: http://localhost:8080
+          connect-token: ${{ secrets.OP_CONNECT_TOKEN }}
+      - name: Load secrets
+        id: load_secrets
+        uses: ./ # 1password/load-secrets-action@<version>
+        with:
+          export-env: true
+        env:
+          SECRET: op://acceptance-tests/test-secret/password
+          SECRET_IN_SECTION: op://acceptance-tests/test-secret/test-section/password
+          MULTILINE_SECRET: op://acceptance-tests/multiline-secret/notesPlain
+      - name: Assert test secret values
+        run: ./tests/assert-env-set.sh
+      - name: Remove secrets
+        uses: ./ # 1password/load-secrets-action@<version>
+        with:
+          unset-previous: true
+      - name: Assert removed secrets
+        run: ./tests/assert-env-unset.sh
+  use-connect-with-references-with-id:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - name: Launch 1Password Connect instance
+        env:
+          OP_CONNECT_CREDENTIALS: ${{ secrets.OP_CONNECT_CREDENTIALS }}
+        run: |
+          echo "$OP_CONNECT_CREDENTIALS" > 1password-credentials.json
+          docker-compose -f tests/fixtures/docker-compose.yml up -d && sleep 10
+      - name: Configure 1Password Connect
+        uses: ./configure # 1password/load-secrets-action/configure@<version>
+        with:
+          connect-host: http://localhost:8080
+          connect-token: ${{ secrets.OP_CONNECT_TOKEN }}
+      - name: Load secrets
+        id: load_secrets
+        uses: ./ # 1password/load-secrets-action@<version>
+        env:
+          SECRET: op://v5pz6venw4roosmkzdq2nhpv6u/hrgkzhrlvscomepxlgafb2m3ca/password
+          SECRET_IN_SECTION: op://v5pz6venw4roosmkzdq2nhpv6u/hrgkzhrlvscomepxlgafb2m3ca/Section_tco6nsqycj6jcbyx63h5isxcny/doxu3mhkozcznnk5vjrkpdqayy
+          MULTILINE_SECRET: op://v5pz6venw4roosmkzdq2nhpv6u/ghtz3jvcc6dqmzc53d3r3eskge/notesPlain
+      - name: Assert test secret values
+        env:
+          SECRET: ${{ steps.load_secrets.outputs.SECRET }}
+          SECRET_IN_SECTION: ${{ steps.load_secrets.outputs.SECRET_IN_SECTION }}
+          MULTILINE_SECRET: ${{ steps.load_secrets.outputs.MULTILINE_SECRET }}
+        run: ./tests/assert-env-set.sh
+  use-service-account-without-export-env:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - name: Load secrets
+        id: load_secrets
+        uses: ./ # 1password/load-secrets-action@<version>
+        env:
+          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
+          SECRET: op://acceptance-tests/test-secret/password
+          SECRET_IN_SECTION: op://acceptance-tests/test-secret/test-section/password
+          MULTILINE_SECRET: op://acceptance-tests/multiline-secret/notesPlain
+      - name: Assert test secret values
+        env:
+          SECRET: ${{ steps.load_secrets.outputs.SECRET }}
+          SECRET_IN_SECTION: ${{ steps.load_secrets.outputs.SECRET_IN_SECTION }}
+          MULTILINE_SECRET: ${{ steps.load_secrets.outputs.MULTILINE_SECRET }}
+        run: ./tests/assert-env-set.sh
+  use-service-account-with-export-env:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - name: Load secrets
+        id: load_secrets
+        uses: ./ # 1password/load-secrets-action@<version>
+        with:
+          export-env: true
+        env:
+          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
+          SECRET: op://acceptance-tests/test-secret/password
+          SECRET_IN_SECTION: op://acceptance-tests/test-secret/test-section/password
+          MULTILINE_SECRET: op://acceptance-tests/multiline-secret/notesPlain
+      - name: Assert test secret values
+        run: ./tests/assert-env-set.sh
+  use-service-account-with-references-with-id:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - name: Load secrets
+        id: load_secrets
+        uses: ./ # 1password/load-secrets-action@<version>
+        env:
+          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
+          SECRET: op://v5pz6venw4roosmkzdq2nhpv6u/hrgkzhrlvscomepxlgafb2m3ca/password
+          SECRET_IN_SECTION: op://v5pz6venw4roosmkzdq2nhpv6u/hrgkzhrlvscomepxlgafb2m3ca/Section_tco6nsqycj6jcbyx63h5isxcny/doxu3mhkozcznnk5vjrkpdqayy
+          MULTILINE_SECRET: op://v5pz6venw4roosmkzdq2nhpv6u/ghtz3jvcc6dqmzc53d3r3eskge/notesPlain
+      - name: Assert test secret values
+        env:
+          SECRET: ${{ steps.load_secrets.outputs.SECRET }}
+          SECRET_IN_SECTION: ${{ steps.load_secrets.outputs.SECRET_IN_SECTION }}
+          MULTILINE_SECRET: ${{ steps.load_secrets.outputs.MULTILINE_SECRET }}
+        run: ./tests/assert-env-set.sh
+  run-on-macos-12:
+    runs-on: macos-12
+    steps:
+      - uses: actions/checkout@v2
+      - name: Load secrets
+        id: load_secrets
+        uses: ./ # 1password/load-secrets-action@<version>
+        env:
+          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
+          SECRET: op://acceptance-tests/test-secret/password
+          SECRET_IN_SECTION: op://acceptance-tests/test-secret/test-section/password
+          MULTILINE_SECRET: op://acceptance-tests/multiline-secret/notesPlain
+      - name: Assert test secret values
+        env:
+          SECRET: ${{ steps.load_secrets.outputs.SECRET }}
+          SECRET_IN_SECTION: ${{ steps.load_secrets.outputs.SECRET_IN_SECTION }}
+          MULTILINE_SECRET: ${{ steps.load_secrets.outputs.MULTILINE_SECRET }}
+        run: ./tests/assert-env-set.sh
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1 @@
-coverage/
 node_modules/
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -1,54 +0,0 @@
-# Contributing
-
-Thank you for your interest in contributing to the 1Password load-secrets-action project 👋! Before you start, please take a moment to read through this guide to understand our contribution process.
-
-## Testing
-
-Unit tests can be run with `npm run test`.
-
-After following the steps below for signing commits, you can test against your PR with these steps:
-
-1. Create or use an existing repo to run the `load-secrets` GitHub Action.
-2. In a workflow yaml file that uses the GitHub Action, modify the `uses: 1Password/load-secrets-action` line to be
-
-   ```yaml
-   uses: 1Password/load-secrets-action@<branch-name>
-   ```
-
-   OR
-
-   ```yaml
-   uses: 1Password/load-secrets-action@<commit-hash>
-   ```
-
-3. Trigger the action, which now includes your changes.
-
-## Documentation Updates
-
-If applicable, update the [README.md](./README.md) to reflect any changes introduced by the new code.
-
-## Sign your commits
-
-To get your PR merged, we require you to sign your commits.
-
-### Sign commits with 1Password
-
-You can also sign commits using 1Password, which lets you sign commits with biometrics without the signing key leaving the local 1Password process.
-
-Learn how to use [1Password to sign your commits](https://developer.1password.com/docs/ssh/git-commit-signing/).
-
-### Sign commits with ssh-agent
-
-Follow the steps below to set up commit signing with `ssh-agent`:
-
-1. [Generate an SSH key and add it to ssh-agent](https://docs.github.com/en/authentication/connecting-to-github-with-ssh/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent)
-2. [Add the SSH key to your GitHub account](https://docs.github.com/en/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account)
-3. [Configure git to use your SSH key for commits signing](https://docs.github.com/en/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key#telling-git-about-your-ssh-key)
-
-### Sign commits with gpg
-
-Follow the steps below to set up commit signing with `gpg`:
-
-1. [Generate a GPG key](https://docs.github.com/en/authentication/managing-commit-signature-verification/generating-a-new-gpg-key)
-2. [Add the GPG key to your GitHub account](https://docs.github.com/en/authentication/managing-commit-signature-verification/adding-a-gpg-key-to-your-github-account)
-3. [Configure git to use your GPG key for commits signing](https://docs.github.com/en/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key#telling-git-about-your-gpg-key)
--- a/README.md
+++ b/README.md
@@ -1,27 +1,38 @@
-<!-- Image sourced from https://blog.1password.com/1password-service-accounts/ -->
-<img alt="" role="img" src="https://blog.1password.com/posts/2023/1password-service-accounts/header.png"/>
+# Load Secrets from 1Password - GitHub Action

-<div align="center">
-  <h1>Load Secrets from 1Password - GitHub Action</h1>
-  <p>Provide the secrets your GitHub runner needs from 1Password.</p>
-  <a href="https://developer.1password.com/docs/ci-cd/github-actions">
-    <img alt="Get started" src="https://user-images.githubusercontent.com/45081667/226940040-16d3684b-60f4-4d95-adb2-5757a8f1bc15.png" height="37"/>
-  </a>
-</div>
-
---
-
-`load-secrets-action` loads secrets from 1Password into GitHub Actions using [Service Accounts](https://developer.1password.com/docs/service-accounts) or [1Password Connect](https://developer.1password.com/docs/connect).
+`load-secrets-action` loads secrets from 1Password into GitHub Actions using [1Password Connect](https://developer.1password.com/docs/connect).

 Specify in your workflow YAML file which secrets from 1Password should be loaded into your job, and the action will make them available as environment variables for the next steps.

-Read more on the [1Password Developer Portal](https://developer.1password.com/docs/ci-cd/github-actions).
+## Requirements

-## 🪄 See it in action!
+Before you get started, you'll need to:

-[![Using 1Password Service Accounts with GitHub Actions - showcase](https://img.youtube.com/vi/kVBl5iQYgSA/maxresdefault.jpg)](https://www.youtube.com/watch?v=kVBl5iQYgSA "Using 1Password Service Accounts with GitHub Actions")
+- [Deploy 1Password Connect](https://developer.1password.com/docs/connect/get-started#step-2-deploy-1password-connect-server) in your infrastructure.
+- Set the `OP_CONNECT_HOST` and `OP_CONNECT_TOKEN` environment variables to your Connect instance's credentials, so it'll be used to load secrets.

-## ✨ Quickstart
+### Supported runners
+
+You can run the action on Mac and Linux runners. Windows is currently not supported.
+
+## 1Password configuration
+
+By default, you'll need to set the environment variables for your Connect instance in the step that uses `load-secrets-action`.
+
+If you're using the action more than once in a single job, [you can use the `configure` action](https://developer.1password.com/docs/connect/github-actions/#1password-configuration) to set the environment variables instead, so you don't have to set them separately in each `load-secrets-action` step.
+
+## Usage
+
+You can load secrets using the action in two ways:
+
+1. [Use secrets from the action's output](#use-secrets-from-the-actions-output)
+2. [Export secrets as environment variables](#export-secrets-as-environment-variables)
+
+### Use secrets from the action's output
+
+This method allows you to use the loaded secrets outputted by the step: `steps.step-id.outputs.secret-name`.
+
+You'll need to set an ID for the step to be able to access its outputs. For more information, see [`outputs.<output_id>`](https://docs.github.com/actions/creating-actions/metadata-syntax-for-github-actions#outputsoutput_id).

 ```yml
 on: push
@@ -29,30 +40,67 @@ jobs:
  hello-world:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v2

      - name: Load secret
-        uses: 1password/load-secrets-action@v2
+        id: op-load-secret
+        uses: 1password/load-secrets-action@v1
+        env:
+          OP_CONNECT_HOST: <Your Connect instance URL>
+          OP_CONNECT_TOKEN: ${{ secrets.OP_CONNECT_TOKEN }}
+          SECRET: op://app-cicd/hello-world/secret
+
+      - name: Print masked secret
+        run: echo "Secret: ${{ steps.op-load-secret.outputs.SECRET }}"
+        # Prints: Secret: ***
+```
+
+[Read the full documentation for more usage examples.](https://developer.1password.com/docs/connect/github-actions/#use-secrets-from-the-actions-output)
+
+### Export secrets as environment variables
+
+This method allows the action to access the loaded secrets as environment variables. These environment variables are accessible at a job level.
+
+```yml
+on: push
+jobs:
+  hello-world:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+
+      - name: Load secret
+        uses: 1password/load-secrets-action@v1
        with:
          # Export loaded secrets as environment variables
          export-env: true
        env:
-          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
+          OP_CONNECT_HOST: <Your Connect instance URL>
+          OP_CONNECT_TOKEN: ${{ secrets.OP_CONNECT_TOKEN }}
          SECRET: op://app-cicd/hello-world/secret

      - name: Print masked secret
-        run: 'echo "Secret: $SECRET"'
+        run: echo "Secret: $SECRET"
        # Prints: Secret: ***
 ```

-## 💙 Community & Support
+[Read the full documentation for more usage examples.](https://developer.1password.com/docs/connect/github-actions/#export-secrets-as-environment-variables)

- File an [issue](https://github.com/1Password/load-secrets-action/issues) for bugs and feature requests.
- Join the [Developer Slack workspace](https://developer.1password.com/joinslack).
- Subscribe to the [Developer Newsletter](https://1password.com/dev-subscribe/).
+## Masking

-## 🔐 Security
+Similar to regular GitHub repository secrets, fields from 1Password will automatically be masked in GitHub Actions logs. If one of these values accidentally gets printed, it'll be replaced with `***`.
+
+## Security

 1Password requests you practice responsible disclosure if you discover a vulnerability.

-Please file requests by sending an email to bugbounty@agilebits.com.
+Please file requests through [BugCrowd](https://bugcrowd.com/agilebits).
+
+[Learn more about our security practices.](https://bugcrowd.com/agilebits)
+
+## Get help
+
+If you find yourself stuck, [contact 1Password support](https://support.1password.com/) for help.
+
+[Read the full documentation](https://developer.1password.com/docs/connect/github-actions/).
+
--- a/action.yml
+++ b/action.yml
@@ -5,15 +5,12 @@ branding:
  icon: lock
  color: blue
 inputs:
-  version:
-    description: Version of the 1Password CLI to install
-    default: latest
  unset-previous:
    description: Whether to unset environment variables populated by 1Password in earlier job steps
-    default: "false"
+    default: false
  export-env:
    description: Export the secrets as environment variables
-    default: "true"
+    default: false
 runs:
-  using: "node20"
-  main: "dist/index.js"
+  using: 'node16'
+  main: 'dist/index.js'
--- a/config/.husky/pre-commit
+++ b/config/.husky/pre-commit
@@ -1,4 +0,0 @@
-#!/usr/bin/env sh
-. "$(dirname -- "$0")/_/husky.sh"
-
-npx lint-staged --config ./config/lint-staged.config.js
--- a/config/.husky/pre-push
+++ b/config/.husky/pre-push
@@ -1,4 +0,0 @@
-#!/usr/bin/env sh
-. "$(dirname -- "$0")/_/husky.sh"
-
-npm run validate
--- a/config/.prettierignore
+++ b/config/.prettierignore
@@ -1,3 +0,0 @@
-coverage/
-dist/
-node_modules/
--- a/config/jest.config.js
+++ b/config/jest.config.js
@@ -1,28 +0,0 @@
-const jestConfig = {
-	/**
-	 * Jest docs: "We recommend placing the extensions most commonly used in your project
-	 *             on the left, so if you are using TypeScript, you may want to consider
-	 *             moving 'ts' to the beginning of the array."
-	 *
-	 * https://jestjs.io/docs/configuration#modulefileextensions-arraystring
-	 */
-	moduleFileExtensions: ["ts", "js", "json"],
-	rootDir: "../src/",
-	testEnvironment: "node",
-	testRegex: "(/__tests__/.*|(\\.|/)test)\\.ts",
-	transform: {
-		".ts": [
-			"ts-jest",
-			{
-				// Note: We shouldn't need to include `isolatedModules` here because it's a deprecated config option in TS 5,
-				// but setting it to `true` fixes the `ESM syntax is not allowed in a CommonJS module when
-				// 'verbatimModuleSyntax' is enabled` error that we're seeing when running our Jest tests.
-				isolatedModules: true,
-				useESM: true,
-			},
-		],
-	},
-	verbose: true,
-};
-
-module.exports = jestConfig;
--- a/config/lint-staged.config.js
+++ b/config/lint-staged.config.js
@@ -1,9 +0,0 @@
-const lintStagedConfig = {
-	// run formatting and linting on all supported file types
-	"*.{js,json,md,ts,yaml,yml}": "npm run format:write",
-	"*.{js,ts}": ["npm run lint:fix"],
-	// run testing on all supported file types within the src/ directory
-	"src/**/*.{js,ts}": ["npm run test -- --findRelatedTests"],
-};
-
-export default lintStagedConfig;
--- a/configure/action.yml
+++ b/configure/action.yml
@@ -9,5 +9,12 @@ inputs:
  service-account-token:
    description: Your 1Password service account token
 runs:
-  using: "node20"
-  main: "dist/index.js"
+  using: composite
+  steps:
+    - shell: bash
+      env:
+        INPUT_CONNECT_HOST: ${{ inputs.connect-host }}
+        INPUT_CONNECT_TOKEN: ${{ inputs.connect-token }}
+        INPUT_SERVICE_ACCOUNT_TOKEN: ${{ inputs.service-account-token }}
+      run: |
+        ${{ github.action_path }}/entrypoint.sh
--- a/configure/dist/index.js
+++ b/configure/dist/index.js
--- a/configure/entrypoint.sh
+++ b/configure/entrypoint.sh
@@ -0,0 +1,21 @@
+#!/bin/bash
+# shellcheck disable=SC2086
+set -e
+
+# Capture Connect configuration in $GITHUB_ENV, giving (optional) inputs 
+# precendence over OP_CONNECT_* environment variables.
+
+OP_CONNECT_HOST="${INPUT_CONNECT_HOST:-$OP_CONNECT_HOST}"
+if [ -n "$OP_CONNECT_HOST" ]; then
+  echo "OP_CONNECT_HOST=$OP_CONNECT_HOST" >> $GITHUB_ENV
+fi
+
+OP_CONNECT_TOKEN="${INPUT_CONNECT_TOKEN:-$OP_CONNECT_TOKEN}"
+if [ -n "$OP_CONNECT_TOKEN" ]; then
+  echo "OP_CONNECT_TOKEN=$OP_CONNECT_TOKEN" >> $GITHUB_ENV
+fi
+
+OP_SERVICE_ACCOUNT_TOKEN="${INPUT_SERVICE_ACCOUNT_TOKEN:-$OP_SERVICE_ACCOUNT_TOKEN}"
+if [ -n "$OP_SERVICE_ACCOUNT_TOKEN" ]; then
+  echo "OP_SERVICE_ACCOUNT_TOKEN=$OP_SERVICE_ACCOUNT_TOKEN" >> $GITHUB_ENV
+fi
--- a/configure/index.js
+++ b/configure/index.js
@@ -1,27 +0,0 @@
-const core = require("@actions/core");
-
-const configure = () => {
-	const OP_CONNECT_HOST =
-		core.getInput("connect-host", { required: false }) ||
-		process.env.OP_CONNECT_HOST;
-	const OP_CONNECT_TOKEN =
-		core.getInput("connect-token", { required: false }) ||
-		process.env.OP_CONNECT_TOKEN;
-	const OP_SERVICE_ACCOUNT_TOKEN =
-		core.getInput("service-account-token", { required: false }) ||
-		process.env.OP_SERVICE_ACCOUNT_TOKEN;
-
-	if (OP_CONNECT_HOST) {
-		core.exportVariable("OP_CONNECT_HOST", OP_CONNECT_HOST);
-	}
-
-	if (OP_CONNECT_TOKEN) {
-		core.exportVariable("OP_CONNECT_TOKEN", OP_CONNECT_TOKEN);
-	}
-
-	if (OP_SERVICE_ACCOUNT_TOKEN) {
-		core.exportVariable("OP_SERVICE_ACCOUNT_TOKEN", OP_SERVICE_ACCOUNT_TOKEN);
-	}
-};
-
-configure();
--- a/dist/index.js
+++ b/dist/index.js
--- a/entrypoint.sh
+++ b/entrypoint.sh
@@ -0,0 +1,120 @@
+#!/bin/bash
+# shellcheck disable=SC2046,SC2001,SC2086
+set -e
+
+readonly CONNECT="CONNECT"
+readonly SERVICE_ACCOUNT="SERVICE_ACCOUNT"
+
+auth_type=$CONNECT
+managed_variables_var="OP_MANAGED_VARIABLES"
+IFS=','
+
+# Unset all secrets managed by 1Password if `unset-previous` is set.
+unset_prev_secrets() {
+  if [ "$INPUT_UNSET_PREVIOUS" == "true" ]; then
+    echo "Unsetting previous values..."
+
+    # Find environment variables that are managed by 1Password.
+    for env_var in "${managed_variables[@]}"; do
+      echo "Unsetting $env_var"
+      unset $env_var
+
+      echo "$env_var=" >> $GITHUB_ENV
+
+      # Keep the masks, just in case.
+    done
+
+    managed_variables=()
+  fi
+}
+
+# Install op-cli
+install_op_cli() {
+  if [[ "$OSTYPE" == "linux-gnu"* ]]; then
+    curl -sSfLo op.zip "https://cache.agilebits.com/dist/1P/op2/pkg/v2.7.1-beta.01/op_linux_amd64_v2.7.1-beta.01.zip"
+    unzip -od /usr/local/bin/ op.zip && rm op.zip
+  elif [[ "$OSTYPE" == "darwin"* ]]; then
+    curl -sSfLo op.pkg "https://cache.agilebits.com/dist/1P/op2/pkg/v2.7.1-beta.01/op_apple_universal_v2.7.1-beta.01.pkg"
+    sudo installer -pkg op.pkg -target /usr/local/bin/ && rm op.pkg
+  fi
+}
+
+populating_secret() {
+  ref=$(printenv $1)
+
+  echo "Populating variable: $1"
+  secret_value=$(op read $ref)
+
+  if [ -z "$secret_value" ]; then
+    echo "Could not find or access secret $ref"
+    exit 1
+  fi
+
+  # Register a mask for the secret to prevent accidental log exposure.
+  # To support multiline secrets, escape percent signs and add a mask per line.
+  escaped_mask_value=$(echo "$secret_value" | sed -e 's/%/%25/g')
+  IFS=$'\n'
+  for line in $escaped_mask_value; do
+    if [ "${#line}" -lt 3 ]; then
+      # To avoid false positives and unreadable logs, omit mask for lines that are too short.
+      continue
+    fi
+    echo "::add-mask::$line"
+  done
+  unset IFS
+
+  if [ "$INPUT_EXPORT_ENV" == "true" ]; then
+    # To support multiline secrets, we'll use the heredoc syntax to populate the environment variables.
+    # As the heredoc identifier, we'll use a randomly generated 64-character string,
+    # so that collisions are practically impossible.
+    random_heredoc_identifier=$(openssl rand -hex 16)
+
+    {
+      # Populate env var, using heredoc syntax with generated identifier
+      echo "$env_var<<${random_heredoc_identifier}"
+      echo "$secret_value"
+      echo "${random_heredoc_identifier}"
+    } >> $GITHUB_ENV
+    echo "GITHUB_ENV: $(cat $GITHUB_ENV)"
+
+  else
+    # Prepare the secret_value to be outputed properly (especially multiline secrets)
+    secret_value=$(echo "$secret_value" | awk -v ORS='%0A' '1')
+
+    echo "::set-output name=$env_var::$secret_value"
+  fi
+
+  managed_variables+=("$env_var")
+}
+
+# Load environment variables using op cli. Iterate over them to find 1Password references, load the secret values,
+# and make them available as environment variables in the next steps.
+extract_secrets() {
+  IFS=$'\n'
+  for env_var in $(op env ls); do
+    populating_secret $env_var
+  done
+}
+
+read -r -a managed_variables <<< "$(printenv $managed_variables_var)"
+
+if [ -z "$OP_CONNECT_TOKEN" ] || [ -z "$OP_CONNECT_HOST" ]; then
+  if [ -z "$OP_SERVICE_ACCOUNT_TOKEN" ]; then
+    echo "(\$OP_CONNECT_TOKEN and \$OP_CONNECT_HOST) or \$OP_SERVICE_ACCOUNT_TOKEN must be set"
+    exit 1
+  fi
+
+  auth_type=$SERVICE_ACCOUNT
+fi
+
+printf "Authenticated with %s \n" $auth_type
+
+unset_prev_secrets
+install_op_cli
+extract_secrets
+
+unset IFS
+# Add extra env var that lists which secrets are managed by 1Password so that in a later step
+# these can be unset again.
+managed_variables_str=$(IFS=','; echo "${managed_variables[*]}")
+echo "$managed_variables_var=$managed_variables_str" >> $GITHUB_ENV
--- a/install_cli.sh
+++ b/install_cli.sh
@@ -1,46 +0,0 @@
-#!/bin/bash
-set -e
-
-# Install op-cli
-install_op_cli() {
-  # Create a temporary directory where the CLI is installed
-  OP_INSTALL_DIR="$(mktemp -d)"
-  if [[ ! -d "$OP_INSTALL_DIR" ]]; then
-    echo "Install dir $OP_INSTALL_DIR not found"
-    exit 1
-  fi
-  echo "::debug::OP_INSTALL_DIR: ${OP_INSTALL_DIR}"
-
-  # Get the latest stable version of the CLI
-  CLI_VERSION="v$(curl https://app-updates.agilebits.com/check/1/0/CLI2/en/2.0.0/N -s | grep -Eo '[0-9]+\.[0-9]+\.[0-9]+')"
-
-  if [[ "$OSTYPE" == "linux-gnu"* ]]; then
-    # Get runner's architecture
-    ARCH=$(uname -m)
-    if [[ "$(getconf LONG_BIT)" = 32 ]]; then
-      ARCH="386"
-    elif [[ "$ARCH" == "x86_64" ]]; then
-      ARCH="amd64"
-    elif [[ "$ARCH" == "aarch64" ]]; then
-      ARCH="arm64"
-    fi
-
-    if [[ "$ARCH" != "386" ]] && [[ "$ARCH" != "amd64" ]] && [[ "$ARCH" != "arm" ]] && [[ "$ARCH" != "arm64" ]]; then
-      echo "Unsupported architecture for the 1Password CLI: $ARCH."
-      exit 1
-    fi
-
-    curl -sSfLo op.zip "https://cache.agilebits.com/dist/1P/op2/pkg/${CLI_VERSION}/op_linux_${ARCH}_${CLI_VERSION}.zip"
-    unzip -od "$OP_INSTALL_DIR" op.zip && rm op.zip
-  elif [[ "$OSTYPE" == "darwin"* ]]; then
-    curl -sSfLo op.pkg "https://cache.agilebits.com/dist/1P/op2/pkg/${CLI_VERSION}/op_apple_universal_${CLI_VERSION}.pkg"
-    pkgutil --expand op.pkg temp-pkg
-    tar -xvf temp-pkg/op.pkg/Payload -C "$OP_INSTALL_DIR"
-    rm -rf temp-pkg && rm op.pkg
-  else
-    echo "Operating system not supported yet for this GitHub Action: $OSTYPE."
-    exit 1
-  fi
-}
-
-install_op_cli
--- a/package-lock.json
+++ b/package-lock.json
--- a/package.json
+++ b/package.json
@@ -1,71 +1,37 @@
 {
-	"name": "load-secrets-action",
-	"version": "2.0.0",
-	"description": "Load Secrets from 1Password",
-	"type": "commonjs",
-	"main": "dist/index.js",
-	"directories": {
-		"test": "tests"
-	},
-	"scripts": {
-		"build": "ncc build ./src/index.ts",
-		"build:configure": "ncc build ./configure/index.js -o ./configure/dist",
-		"format": "prettier --ignore-path ./config/.prettierignore",
-		"format:check": "npm run format -- --check ./",
-		"format:write": "npm run format -- --write ./",
-		"lint": "eslint ./",
-		"lint:fix": "npm run lint -- --fix",
-		"prepare": "husky install ./config/.husky",
-		"test": "jest --config=./config/jest.config.js",
-		"test:clearcache": "jest --clearCache",
-		"test:coverage": "npm run test -- --coverage",
-		"test:watch": "npm run test -- --watch",
-		"typecheck": "tsc",
-		"validate": "npm run format:check && npm run lint && npm run test:coverage && npm run typecheck && npm run build"
-	},
-	"repository": {
-		"type": "git",
-		"url": "git+https://github.com/1Password/load-secrets-action.git"
-	},
-	"keywords": [
-		"actions",
-		"1password",
-		"load secrets",
-		"connect"
-	],
-	"author": "1Password",
-	"license": "MIT",
-	"bugs": {
-		"url": "https://github.com/1Password/load-secrets-action/issues"
-	},
-	"homepage": "https://github.com/1Password/load-secrets-action#readme",
-	"dependencies": {
-		"@1password/install-cli-action": "github:1password/install-cli-action#vzt/export-install-function",
-		"@1password/op-js": "^0.1.11",
-		"@actions/core": "^1.11.1",
-		"@actions/exec": "^1.1.1",
-		"@actions/tool-cache": "^2.0.2"
-	},
-	"devDependencies": {
-		"@1password/eslint-config": "^4.3.1",
-		"@1password/prettier-config": "^1.2.0",
-		"@types/jest": "^29.5.12",
-		"@types/node": "^20.11.30",
-		"@vercel/ncc": "^0.38.1",
-		"husky": "^9.0.11",
-		"jest": "^29.7.0",
-		"lint-staged": "^15.2.2",
-		"ts-jest": "^29.1.2",
-		"typescript": "^5.4.2"
-	},
-	"eslintConfig": {
-		"extends": "@1password/eslint-config",
-		"ignorePatterns": [
-			"coverage/"
-		],
-		"parserOptions": {
-			"project": "./tsconfig.json"
-		}
-	},
-	"prettier": "@1password/prettier-config"
+  "name": "load-secrets-action",
+  "version": "1.1.0",
+  "description": "Load Secrets from 1Password",
+  "main": "dist/index.js",
+  "directories": {
+    "test": "tests"
+  },
+  "scripts": {
+    "build": "ncc build src/index.ts"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/1Password/load-secrets-action.git"
+  },
+  "keywords": [
+    "actions",
+    "1password",
+    "load secrets",
+    "connect"
+  ],
+  "author": "1Password",
+  "license": "MIT",
+  "bugs": {
+    "url": "https://github.com/1Password/load-secrets-action/issues"
+  },
+  "homepage": "https://github.com/1Password/load-secrets-action#readme",
+  "dependencies": {
+    "@actions/core": "^1.9.1",
+    "@actions/exec": "^1.1.1"
+  },
+  "devDependencies": {
+    "@types/node": "^18.7.14",
+    "@vercel/ncc": "^0.34.0",
+    "typescript": "^4.8.2"
+  }
 }
--- a/src/constants.ts
+++ b/src/constants.ts
@@ -1,6 +0,0 @@
-export const envConnectHost = "OP_CONNECT_HOST";
-export const envConnectToken = "OP_CONNECT_TOKEN";
-export const envServiceAccountToken = "OP_SERVICE_ACCOUNT_TOKEN";
-export const envManagedVariables = "OP_MANAGED_VARIABLES";
-
-export const authErr = `Authentication error with environment variables: you must set either 1) ${envServiceAccountToken}, or 2) both ${envConnectHost} and ${envConnectToken}.`;
--- a/src/index.ts
+++ b/src/index.ts
@@ -1,53 +1,21 @@
-import * as core from "@actions/core";
-import { validateCli } from "@1password/op-js";
-import { loadSecrets, unsetPrevious, validateAuth } from "./utils";
+import * as core from '@actions/core';
+import * as exec from '@actions/exec';
+import path from 'path';

-const loadSecretsAction = async () => {
-	try {
-		// Get action inputs
-		const shouldUnsetPrevious = core.getBooleanInput("unset-previous");
-		const shouldExportEnv = core.getBooleanInput("export-env");
+async function run(): Promise<void> {
+  try {
+    const parentDir = path.resolve(__dirname, '..');
+    
+    // Get action inputs
+    process.env.INPUT_UNSET_PREVIOUS = core.getInput('unset-previous');
+    process.env.INPUT_EXPORT_ENV = core.getInput('export-env');

-		// Unset all secrets managed by 1Password if `unset-previous` is set.
-		if (shouldUnsetPrevious) {
-			unsetPrevious();
-		}
+    // Execute bash script
+    await exec.exec(`sh -c "` + parentDir + `/entrypoint.sh"`);

-		// Validate that a proper authentication configuration is set for the CLI
-		validateAuth();
+  } catch (error: any) {
+    core.setFailed(error.message);
+  }
+}

-		// Download and install the CLI
-		await installCLI();
-
-		// Load secrets
-		await loadSecrets(shouldExportEnv);
-	} catch (error) {
-		// It's possible for the Error constructor to be modified to be anything
-		// in JavaScript, so the following code accounts for this possibility.
-		// https://kentcdodds.com/blog/get-a-catch-block-error-message-with-typescript
-		let message = "Unknown Error";
-		if (error instanceof Error) {
-			message = error.message;
-		} else {
-			String(error);
-		}
-		core.setFailed(message);
-	}
-};
-
-// This function's name is an exception from the naming convention
-// since we refer to the 1Password CLI here.
-// eslint-disable-next-line @typescript-eslint/naming-convention
-const installCLI = async (): Promise<void> => {
-	// validateCli checks if there's an existing 1Password CLI installed on the runner.
-	// If there's no CLI installed, then validateCli will throw an error, which we will use
-	// as an indicator that we need to execute the installation script.
-	await validateCli().catch(async () => {
-		// eslint-disable-next-line
-		const { install } = require("@1password/install-cli-action");
-		// eslint-disable-next-line @typescript-eslint/no-unsafe-call
-		await install();
-	});
-};
-
-void loadSecretsAction();
+run();
--- a/src/utils.test.ts
+++ b/src/utils.test.ts
@@ -1,164 +0,0 @@
-import * as core from "@actions/core";
-import * as exec from "@actions/exec";
-import { read, setClientInfo } from "@1password/op-js";
-import {
-	extractSecret,
-	loadSecrets,
-	unsetPrevious,
-	validateAuth,
-} from "./utils";
-import {
-	authErr,
-	envConnectHost,
-	envConnectToken,
-	envManagedVariables,
-	envServiceAccountToken,
-} from "./constants";
-
-jest.mock("@actions/core");
-jest.mock("@actions/exec", () => ({
-	getExecOutput: jest.fn(() => ({
-		stdout: "MOCK_SECRET",
-	})),
-}));
-jest.mock("@1password/op-js");
-
-beforeEach(() => {
-	jest.clearAllMocks();
-});
-
-describe("validateAuth", () => {
-	const testConnectHost = "https://localhost:8000";
-	const testConnectToken = "token";
-	const testServiceAccountToken = "ops_token";
-
-	beforeEach(() => {
-		process.env[envConnectHost] = "";
-		process.env[envConnectToken] = "";
-		process.env[envServiceAccountToken] = "";
-	});
-
-	it("should throw an error when no config is provided", () => {
-		expect(validateAuth).toThrow(authErr);
-	});
-
-	it("should throw an error when partial Connect config is provided", () => {
-		process.env[envConnectHost] = testConnectHost;
-		expect(validateAuth).toThrow(authErr);
-	});
-
-	it("should be authenticated as a Connect client", () => {
-		process.env[envConnectHost] = testConnectHost;
-		process.env[envConnectToken] = testConnectToken;
-		expect(validateAuth).not.toThrow(authErr);
-		expect(core.info).toHaveBeenCalledWith("Authenticated with Connect.");
-	});
-
-	it("should be authenticated as a service account", () => {
-		process.env[envServiceAccountToken] = testServiceAccountToken;
-		expect(validateAuth).not.toThrow(authErr);
-		expect(core.info).toHaveBeenCalledWith(
-			"Authenticated with Service account.",
-		);
-	});
-
-	it("should prioritize Connect over service account if both are configured", () => {
-		process.env[envServiceAccountToken] = testServiceAccountToken;
-		process.env[envConnectHost] = testConnectHost;
-		process.env[envConnectToken] = testConnectToken;
-		expect(validateAuth).not.toThrow(authErr);
-		expect(core.warning).toHaveBeenCalled();
-		expect(core.info).toHaveBeenCalledWith("Authenticated with Connect.");
-	});
-});
-
-describe("extractSecret", () => {
-	const envTestSecretEnv = "TEST_SECRET";
-	const testSecretRef = "op://vault/item/secret";
-	const testSecretValue = "Secret1@3$";
-
-	read.parse = jest.fn().mockReturnValue(testSecretValue);
-
-	process.env[envTestSecretEnv] = testSecretRef;
-
-	it("should set secret as step output", () => {
-		extractSecret(envTestSecretEnv, false);
-		expect(core.exportVariable).not.toHaveBeenCalledWith(
-			envTestSecretEnv,
-			testSecretValue,
-		);
-		expect(core.setOutput).toHaveBeenCalledWith(
-			envTestSecretEnv,
-			testSecretValue,
-		);
-		expect(core.setSecret).toHaveBeenCalledWith(testSecretValue);
-	});
-
-	it("should set secret as environment variable", () => {
-		extractSecret(envTestSecretEnv, true);
-		expect(core.exportVariable).toHaveBeenCalledWith(
-			envTestSecretEnv,
-			testSecretValue,
-		);
-		expect(core.setOutput).not.toHaveBeenCalledWith(
-			envTestSecretEnv,
-			testSecretValue,
-		);
-		expect(core.setSecret).toHaveBeenCalledWith(testSecretValue);
-	});
-});
-
-describe("loadSecrets", () => {
-	it("sets the client info and gets the executed output", async () => {
-		await loadSecrets(true);
-
-		expect(setClientInfo).toHaveBeenCalledWith({
-			name: "1Password GitHub Action",
-			id: "GHA",
-		});
-		expect(exec.getExecOutput).toHaveBeenCalledWith('sh -c "op env ls"');
-		expect(core.exportVariable).toHaveBeenCalledWith(
-			"OP_MANAGED_VARIABLES",
-			"MOCK_SECRET",
-		);
-	});
-
-	it("return early if no env vars with secrets found", async () => {
-		(exec.getExecOutput as jest.Mock).mockReturnValueOnce({ stdout: "" });
-		await loadSecrets(true);
-
-		expect(exec.getExecOutput).toHaveBeenCalledWith('sh -c "op env ls"');
-		expect(core.exportVariable).not.toHaveBeenCalled();
-	});
-
-	describe("core.exportVariable", () => {
-		it("is called when shouldExportEnv is true", async () => {
-			await loadSecrets(true);
-
-			expect(core.exportVariable).toHaveBeenCalledTimes(1);
-		});
-
-		it("is not called when shouldExportEnv is false", async () => {
-			await loadSecrets(false);
-
-			expect(core.exportVariable).not.toHaveBeenCalled();
-		});
-	});
-});
-
-describe("unsetPrevious", () => {
-	const testManagedEnv = "TEST_SECRET";
-	const testSecretValue = "MyS3cr#T";
-
-	beforeEach(() => {
-		process.env[testManagedEnv] = testSecretValue;
-		process.env[envManagedVariables] = testManagedEnv;
-	});
-
-	it("should unset the environment variable if user wants it", () => {
-		unsetPrevious();
-		expect(core.info).toHaveBeenCalledWith("Unsetting previous values ...");
-		expect(core.info).toHaveBeenCalledWith("Unsetting TEST_SECRET");
-		expect(core.exportVariable).toHaveBeenCalledWith("TEST_SECRET", "");
-	});
-});
--- a/src/utils.ts
+++ b/src/utils.ts
@@ -1,91 +0,0 @@
-import * as core from "@actions/core";
-import * as exec from "@actions/exec";
-import { read, setClientInfo, semverToInt } from "@1password/op-js";
-import { version } from "../package.json";
-import {
-	authErr,
-	envConnectHost,
-	envConnectToken,
-	envServiceAccountToken,
-	envManagedVariables,
-} from "./constants";
-
-export const validateAuth = (): void => {
-	const isConnect = process.env[envConnectHost] && process.env[envConnectToken];
-	const isServiceAccount = process.env[envServiceAccountToken];
-
-	if (isConnect && isServiceAccount) {
-		core.warning(
-			"WARNING: Both service account and Connect credentials are provided. Connect credentials will take priority.",
-		);
-	}
-
-	if (!isConnect && !isServiceAccount) {
-		throw new Error(authErr);
-	}
-
-	const authType = isConnect ? "Connect" : "Service account";
-
-	core.info(`Authenticated with ${authType}.`);
-};
-
-export const extractSecret = (
-	envName: string,
-	shouldExportEnv: boolean,
-): void => {
-	core.info(`Populating variable: ${envName}`);
-
-	const ref = process.env[envName];
-	if (!ref) {
-		return;
-	}
-
-	const secretValue = read.parse(ref);
-	if (!secretValue) {
-		return;
-	}
-
-	if (shouldExportEnv) {
-		core.exportVariable(envName, secretValue);
-	} else {
-		core.setOutput(envName, secretValue);
-	}
-	core.setSecret(secretValue);
-};
-
-export const loadSecrets = async (shouldExportEnv: boolean): Promise<void> => {
-	// Pass User-Agent Information to the 1Password CLI
-	setClientInfo({
-		name: "1Password GitHub Action",
-		id: "GHA",
-		build: semverToInt(version),
-	});
-
-	// Load secrets from environment variables using 1Password CLI.
-	// Iterate over them to find 1Password references, extract the secret values,
-	// and make them available in the next steps either as step outputs or as environment variables.
-	const res = await exec.getExecOutput(`sh -c "op env ls"`);
-
-	if (res.stdout === "") {
-		return;
-	}
-
-	const envs = res.stdout.replace(/\n+$/g, "").split(/\r?\n/);
-	for (const envName of envs) {
-		extractSecret(envName, shouldExportEnv);
-	}
-	if (shouldExportEnv) {
-		core.exportVariable(envManagedVariables, envs.join());
-	}
-};
-
-export const unsetPrevious = (): void => {
-	if (process.env[envManagedVariables]) {
-		core.info("Unsetting previous values ...");
-		const managedEnvs = process.env[envManagedVariables].split(",");
-		for (const envName of managedEnvs) {
-			core.info(`Unsetting ${envName}`);
-			core.exportVariable(envName, "");
-		}
-	}
-};
--- a/tests/assert-cli-version.sh
+++ b/tests/assert-cli-version.sh
@@ -1,30 +0,0 @@
-#!/bin/bash
-set -e
-
-OP_CLI_VERSION="$1"
-CLI_URL="https://app-updates.agilebits.com/product_history/CLI2"
-
-get_latest_cli_version() {
-    conditional_path="/beta/"
-    if [ "$1" == "non_beta" ]; then
-        conditional_path="!/beta/"
-    fi
-    # This long command parses the HTML page at "CLI_URL" and finds the latest CLI version
-    # based on the release channel we're looking for (stable or beta).
-    #
-    # The ideal call (i.e. 'curl https://app-updates.agilebits.com/check/1/0/CLI2/en/2.0.0/Y -s | jq -r .version')
-    # doesn't retrieve the latest CLI version on a channel basis.
-    # If the latest release is stable and we want the latest beta, this command will return the stable still.
-    OP_CLI_VERSION="$(curl -s $CLI_URL | awk -v RS='<h3>|</h3>' 'NR % 2 == 0 {gsub(/[[:blank:]]+/, ""); gsub(/<span[^>]*>|<\/span>|[\r\n]+/, ""); gsub(/&nbsp;.*$/, ""); if (!'"$1"' && '"$conditional_path"'){print; '"$1"'=1;}}')"
-}
-
-if [ "$OP_CLI_VERSION" == "latest" ]; then
-    get_latest_cli_version non_beta
-elif [ "$OP_CLI_VERSION" == "latest-beta" ]; then
-    get_latest_cli_version beta
-fi
-
-if [ "$(op --version)" != "$OP_CLI_VERSION" ]; then
-    echo -e "Expected CLI version to be:\n$OP_CLI_VERSION\nBut got:\n$(op --version)"
-    exit 1
-fi
--- a/tsconfig.json
+++ b/tsconfig.json
@@ -1,23 +1,13 @@
 {
-	"compilerOptions": {
-		"allowJs": false,
-		"allowUnreachableCode": false,
-		"allowUnusedLabels": false,
-		"esModuleInterop": true,
-		"exactOptionalPropertyTypes": true,
-		"forceConsistentCasingInFileNames": true,
-		"module": "esnext",
-		"moduleResolution": "node",
-		"noEmit": true,
-		"noEmitOnError": true,
-		"noFallthroughCasesInSwitch": true,
-		"noImplicitReturns": true,
-		"noUncheckedIndexedAccess": true,
-		"noUnusedLocals": true,
-		"noUnusedParameters": true,
-		"resolveJsonModule": true,
-		"strict": true,
-		"target": "es2022",
-		"verbatimModuleSyntax": true
-	}
+    "compilerOptions": {
+        "target": "es6",
+        "module": "commonjs",
+        "moduleResolution": "node",
+        "outDir": "./dist",
+        "rootDir": "./src",
+        "strict": true,
+        "noImplicitAny": true,
+        "esModuleInterop": true
+    },
+    "exclude": ["node_modules"]
 }
Author	SHA1	Message	Date
Lucy Butcher	ea085fcce0	Added basic usage examples to readme Some checks failed Run acceptance tests / use-connect-without-export-env (push) Has been cancelled Details Run acceptance tests / use-connect-with-export-env (push) Has been cancelled Details Run acceptance tests / use-connect-with-references-with-id (push) Has been cancelled Details Run acceptance tests / use-service-account-without-export-env (push) Has been cancelled Details Run acceptance tests / use-service-account-with-export-env (push) Has been cancelled Details Run acceptance tests / use-service-account-with-references-with-id (push) Has been cancelled Details Run acceptance tests / run-on-macos-12 (push) Has been cancelled Details	2022-10-18 09:03:48 -04:00
Lucy Butcher	85386695a5	Update readme to link to developer portal This MR updates the readme to: - Match the final edited text used in the developer portal - Link out to the developer portal for usage examples beyond basic setup	2022-10-03 09:26:54 -04:00