feat!: migrate CI secrets to 1Password via load-secrets-action - #107
Merged
Conversation
Replace per-workflow GitHub secrets with a single OP_SERVICE_ACCOUNT_TOKEN. All credentials (Pantheon, Slack, GitHub PAT) now resolve at runtime from the s360-cicd 1Password vault using op:// URIs. Each job loads only the secrets it needs. BREAKING CHANGE: callers must remove PANTHEON_SSH_KEY, PANTHEON_MACHINE_TOKEN, CI_GH_TOKEN, and SLACK_BOT_TOKEN from their secrets: blocks and pass OP_SERVICE_ACCOUNT_TOKEN instead. Co-Authored-By: Claude
Replace PANTHEON_SSH_KEY, PANTHEON_MACHINE_TOKEN, SLACK_BOT_TOKEN, CLICKUP_API_TOKEN, and CLICKUP_TEAM_ID with OP_SERVICE_ACCOUNT_TOKEN. Each job loads only the secrets it needs from the s360-cicd vault. Co-Authored-By: Claude
All specialized multidev reusable workflows (pr, rc, epic) and the security-scan and VRT workflows now accept a single OP_SERVICE_ACCOUNT_TOKEN instead of individual GitHub secrets. Each job loads its own secrets from the s360-cicd vault via 1password/load-secrets-action at runtime. Co-Authored-By: Claude
Contributor
There was a problem hiding this comment.
Pull request overview
This PR migrates the repository’s reusable GitHub Actions workflows away from multiple GitHub org/repo secrets and onto 1Password load-secrets-action@v2, standardizing callers on a single OP_SERVICE_ACCOUNT_TOKEN secret and switching secret consumption from ${{ secrets.* }} to ${{ env.* }}.
Changes:
- Replaces per-workflow secret lists with a single required
OP_SERVICE_ACCOUNT_TOKENacross the reusable workflows. - Adds 1Password “Configure + Load secrets” step pairs and exports needed credentials to the job environment.
- Updates downstream workflow calls to explicitly forward
OP_SERVICE_ACCOUNT_TOKENand updates token usage sites to read fromenv.
Reviewed changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/reusable-semantic-release.yml | Loads CI_GH_TOKEN from 1Password and uses it via ${{ env.CI_GH_TOKEN }}. |
| .github/workflows/reusable-pantheon-vrt.yml | Loads Pantheon/AWS/ClickUp/Slack credentials from 1Password and switches usage to env.*. |
| .github/workflows/reusable-pantheon-security-scan.yml | Loads Pantheon/AWS/ClickUp/Slack credentials from 1Password and switches usage to env.*. |
| .github/workflows/reusable-pantheon-deploy-rc-multidev.yml | Loads Pantheon secrets from 1Password and forwards OP_SERVICE_ACCOUNT_TOKEN to sub-workflows. |
| .github/workflows/reusable-pantheon-deploy-pr-multidev.yml | Loads Pantheon/ClickUp secrets from 1Password and forwards OP_SERVICE_ACCOUNT_TOKEN to sub-workflows. |
| .github/workflows/reusable-pantheon-deploy-epic-multidev.yml | Loads Pantheon/ClickUp secrets from 1Password and forwards OP_SERVICE_ACCOUNT_TOKEN to sub-workflows. |
| .github/workflows/reusable-pantheon-deploy-dev.yml | Loads Pantheon/Slack secrets from 1Password and forwards OP_SERVICE_ACCOUNT_TOKEN to semantic-release. |
| .github/workflows/reusable-deploy-multidev.yml | Loads Pantheon/ClickUp/Slack secrets from 1Password and switches usage to env.* (but introduces YAML issues in steps: indentation). |
Comment on lines
44
to
48
| steps: | ||
| - uses: actions/checkout@v6 | ||
| with: | ||
| # Use shallow clone to let pantheon action handle unshallowing | ||
| fetch-depth: 1 |
Comment on lines
301
to
317
| steps: | ||
| - name: Configure 1Password | ||
| uses: 1password/load-secrets-action/configure@v2 | ||
| with: | ||
| service-account-token: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }} | ||
|
|
||
| - name: Load secrets | ||
| uses: 1password/load-secrets-action@v2 | ||
| with: | ||
| export-env: true | ||
| env: | ||
| SLACK_BOT_TOKEN: op://s360-cicd/slack/bot-token | ||
|
|
||
| - name: Send Slack notification | ||
| env: | ||
| SLACK_BOT_TOKEN: ${{ env.SLACK_BOT_TOKEN }} | ||
| run: | |
| CLICKUP_API_TOKEN: ${{ env.CLICKUP_API_TOKEN }} | ||
| CLICKUP_TEAM_ID: ${{ env.CLICKUP_TEAM_ID }} | ||
| run: | | ||
| set -x |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Migrates all Square360 shared GitHub Actions workflows from individual GitHub org secrets to 1Password's
load-secrets-actionv2.OP_SERVICE_ACCOUNT_TOKENsecretop://s360-cicd/...URIs)OP_SERVICE_ACCOUNT_TOKENexplicitly${{ secrets.X }}references replaced with${{ env.X }}Validated end-to-end on budgetlab PR #68 (
feat/1password-beta→YBL-404) — all jobs green including Pantheon deploy, ClickUp comment, and Slack notification.Breaking change
Callers must now pass a single
OP_SERVICE_ACCOUNT_TOKENsecret instead of the previous 9 individual secrets. Existing callers passing the old secrets will silently ignore the extras, but the secrets will no longer be loaded from GitHub — update all caller workflows to passOP_SERVICE_ACCOUNT_TOKEN.Test plan
v4.0.0-beta.3) — run 27583245663 all jobs green🤖 Generated with Claude Code
BREAKING CHANGE: moved secrets to 1Password