feat!: migrate CI secrets to 1Password via load-secrets-action

.github/workflows/reusable-deploy-multidev.yml

@@ -21,16 +21,9 @@ on:
         type: boolean
         default: false
     secrets:
-      PANTHEON_SSH_KEY:
+      OP_SERVICE_ACCOUNT_TOKEN:
         required: true
-      PANTHEON_MACHINE_TOKEN:
-        required: true
-      SLACK_BOT_TOKEN:
-        required: false
-      CLICKUP_API_TOKEN:
-        required: false
-      CLICKUP_TEAM_ID:
-        required: false
+        description: '1Password service account token — loads all CI secrets from s360-cicd vault'
 
 defaults:
   run:
@@ -54,9 +47,24 @@ jobs:
         # Use shallow clone to let pantheon action handle unshallowing
         fetch-depth: 1
 
+    - name: Configure 1Password
+      uses: 1password/load-secrets-action/configure@v2
+      with:
+        service-account-token: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
+
+    - name: Load secrets
+      uses: 1password/load-secrets-action@v2
+      with:
+        export-env: true
+      env:
+        PANTHEON_MACHINE_TOKEN: op://s360-cicd/pantheon/machine-token
+        PANTHEON_SSH_KEY: op://s360-cicd/pantheon/ssh-key
+        CLICKUP_API_TOKEN: op://s360-cicd/clickup/api-token
+        CLICKUP_TEAM_ID: op://s360-cicd/clickup/team-id
+
     - name: Install Terminus
       env:
-        TERMINUS_MACHINE_TOKEN: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
+        TERMINUS_MACHINE_TOKEN: ${{ env.PANTHEON_MACHINE_TOKEN }}
       run: |
         TERMINUS_VERSION=$(curl -s https://api.github.com/repos/pantheon-systems/terminus/releases/latest | grep '"tag_name"' | cut -d'"' -f4)
         curl -fsSL "https://github.com/pantheon-systems/terminus/releases/download/${TERMINUS_VERSION}/terminus.phar" -o /usr/local/bin/terminus
@@ -67,7 +75,7 @@ jobs:
     - name: Determine source environment
       id: source_env
       env:
-        TERMINUS_MACHINE_TOKEN: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
+        TERMINUS_MACHINE_TOKEN: ${{ env.PANTHEON_MACHINE_TOKEN }}
       run: |
         TARGET_ENV="${{ inputs.target_env }}"
 
@@ -94,7 +102,7 @@ jobs:
     - name: Check if multidev environment exists
       id: check_env
       env:
-        TERMINUS_MACHINE_TOKEN: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
+        TERMINUS_MACHINE_TOKEN: ${{ env.PANTHEON_MACHINE_TOKEN }}
       run: |
         echo "Checking if environment ${{ inputs.pantheon_site }}.${{ inputs.target_env }} exists..."
         terminus env:info ${{ inputs.pantheon_site }}.${{ inputs.target_env }} && ENV_EXISTS=true || ENV_EXISTS=false
@@ -138,8 +146,8 @@ jobs:
       env:
         COMPOSER_NO_SECURITY_BLOCKING: 1
       with:
-        ssh_key: ${{ secrets.PANTHEON_SSH_KEY }}
-        machine_token: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
+        ssh_key: ${{ env.PANTHEON_SSH_KEY }}
+        machine_token: ${{ env.PANTHEON_MACHINE_TOKEN }}
         site: ${{ inputs.pantheon_site }}
         target_env: ${{ inputs.target_env }}
         source_env: ${{ steps.source_env.outputs.source_env }}
@@ -153,7 +161,7 @@ jobs:
       if: ${{ !inputs.workflow_skip_terminus }}
       id: drush_commands
       env:
-        TERMINUS_MACHINE_TOKEN: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
+        TERMINUS_MACHINE_TOKEN: ${{ env.PANTHEON_MACHINE_TOKEN }}
       run: |
         # Check PR title for order preference and verbosity
         # Use HERE document to safely handle all special characters
@@ -184,7 +192,7 @@ jobs:
     - name: Get multidev URL
       id: multidev_url
       env:
-        TERMINUS_MACHINE_TOKEN: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
+        TERMINUS_MACHINE_TOKEN: ${{ env.PANTHEON_MACHINE_TOKEN }}
       run: |
         URL=$(terminus env:view ${{ inputs.pantheon_site }}.${{ inputs.target_env }} --print)
         echo "url=$URL" >> $GITHUB_OUTPUT
@@ -194,8 +202,8 @@ jobs:
       id: clickup_comment
       continue-on-error: true
       env:
-        CLICKUP_API_TOKEN: ${{ secrets.CLICKUP_API_TOKEN }}
-        CLICKUP_TEAM_ID: ${{ secrets.CLICKUP_TEAM_ID }}
+        CLICKUP_API_TOKEN: ${{ env.CLICKUP_API_TOKEN }}
+        CLICKUP_TEAM_ID: ${{ env.CLICKUP_TEAM_ID }}
       run: |
         set -x
         if [[ -z "$CLICKUP_API_TOKEN" || -z "$CLICKUP_TEAM_ID" ]]; then
@@ -291,7 +299,21 @@ jobs:
     if: ${{ always() && inputs.slack_channel }}
     runs-on: ubuntu-latest
     steps:
+    - name: Configure 1Password
+      uses: 1password/load-secrets-action/configure@v2
+      with:
+        service-account-token: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
+
+    - name: Load secrets
+      uses: 1password/load-secrets-action@v2
+      with:
+        export-env: true
+      env:
+        SLACK_BOT_TOKEN: op://s360-cicd/slack/bot-token
+
     - name: Send Slack notification
+      env:
+        SLACK_BOT_TOKEN: ${{ env.SLACK_BOT_TOKEN }}
       run: |
         # Determine status and message
         if [[ "${{ needs.deploy_to_multidev.result }}" == "success" ]]; then
@@ -343,8 +365,8 @@ jobs:
         fi
 
         # Send to Slack using Bot API
-        if [[ -n "${{ secrets.SLACK_BOT_TOKEN }}" ]]; then
-          curl -X POST -H "Authorization: Bearer ${{ secrets.SLACK_BOT_TOKEN }}" \
+        if [[ -n "$SLACK_BOT_TOKEN" ]]; then
+          curl -X POST -H "Authorization: Bearer $SLACK_BOT_TOKEN" \
             -H 'Content-type: application/json; charset=utf-8' \
             --data "{
               \"channel\": \"${{ inputs.slack_channel }}\",

.github/workflows/reusable-pantheon-deploy-dev.yml

@@ -16,6 +16,11 @@ name: Reusable Deploy to Pantheon DEV
 #
 # PR-title flag support is delegated to pantheon-post-deploy-drush:
 #   [verbose]  — pass -v to drush deploy
+#
+# v4: secrets loaded from 1Password via OP_SERVICE_ACCOUNT_TOKEN.
+#     The only GitHub secret required is OP_SERVICE_ACCOUNT_TOKEN (org-level).
+#     All other credentials (Pantheon, Slack) are resolved at runtime from
+#     the s360-cicd vault.
 # -----------------------------------------------------------------------------
 
 on:
@@ -45,14 +50,9 @@ on:
         type: boolean
         default: false
     secrets:
-      PANTHEON_SSH_KEY:
-        required: true
-      PANTHEON_MACHINE_TOKEN:
+      OP_SERVICE_ACCOUNT_TOKEN:
         required: true
-      CI_GH_TOKEN:
-        required: false
-      SLACK_BOT_TOKEN:
-        required: false
+        description: '1Password service account token — loads all CI secrets from s360-cicd vault'
 
 defaults:
   run:
@@ -62,9 +62,9 @@ jobs:
   semantic_release:
     name: Semantic Release
     if: ${{ inputs.run_semantic_release }}
-    uses: Square360/shared-workflows/.github/workflows/reusable-semantic-release.yml@v3.2.6
+    uses: Square360/shared-workflows/.github/workflows/reusable-semantic-release.yml@v4.0.0-beta.1
     secrets:
-      CI_GH_TOKEN: ${{ secrets.CI_GH_TOKEN }}
+      OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
 
   deploy_to_pantheon_dev:
     name: Deploy to Pantheon DEV
@@ -91,23 +91,36 @@ jobs:
           # Shallow clone — pantheon-systems/push-to-pantheon handles unshallowing.
           fetch-depth: 1
 
+      - name: Configure 1Password
+        uses: 1password/load-secrets-action/configure@v2
+        with:
+          service-account-token: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
+
+      - name: Load secrets
+        uses: 1password/load-secrets-action@v2
+        with:
+          export-env: true
+        env:
+          PANTHEON_MACHINE_TOKEN: op://s360-cicd/pantheon/machine-token
+          PANTHEON_SSH_KEY: op://s360-cicd/pantheon/ssh-key
+
       - name: Install Terminus
-        uses: Square360/shared-workflows/.github/actions/terminus-install@v3.2.6
+        uses: Square360/shared-workflows/.github/actions/terminus-install@v4.0.0-beta.1
         with:
-          machine_token: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
+          machine_token: ${{ env.PANTHEON_MACHINE_TOKEN }}
 
       # -----------------------------------------------------------------------
       # Push code to Pantheon DEV. target_env is hardcoded; source_env is
       # intentionally omitted (no multidev clone for a real env deploy).
       # -----------------------------------------------------------------------
       - name: Push code to Pantheon DEV
         id: deploy_pantheon
-        uses: Square360/shared-workflows/.github/actions/pantheon-push@v3.2.6
+        uses: Square360/shared-workflows/.github/actions/pantheon-push@v4.0.0-beta.1
         with:
           site: ${{ inputs.pantheon_site }}
           target_env: dev
-          ssh_key: ${{ secrets.PANTHEON_SSH_KEY }}
-          machine_token: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
+          ssh_key: ${{ env.PANTHEON_SSH_KEY }}
+          machine_token: ${{ env.PANTHEON_MACHINE_TOKEN }}
 
       # -----------------------------------------------------------------------
       # Backup-on-live safety net: if the last live backup is older than the
@@ -122,7 +135,7 @@ jobs:
       - name: Check last live backup age
         id: last_backup
         env:
-          TERMINUS_MACHINE_TOKEN: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
+          TERMINUS_MACHINE_TOKEN: ${{ env.PANTHEON_MACHINE_TOKEN }}
           SITE: ${{ inputs.pantheon_site }}
           THRESHOLD_HOURS: ${{ inputs.backup_hours_threshold }}
         run: |
@@ -150,7 +163,7 @@ jobs:
         id: create_backup
         if: ${{ steps.last_backup.outputs.needs_backup == 'true' }}
         env:
-          TERMINUS_MACHINE_TOKEN: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
+          TERMINUS_MACHINE_TOKEN: ${{ env.PANTHEON_MACHINE_TOKEN }}
           SITE: ${{ inputs.pantheon_site }}
         run: |
           echo "Creating backup on live (keep-for 30 days)"
@@ -159,18 +172,18 @@ jobs:
 
       - name: Run post-deploy drush commands
         id: drush_commands
-        uses: Square360/shared-workflows/.github/actions/pantheon-post-deploy-drush@v3.2.6
+        uses: Square360/shared-workflows/.github/actions/pantheon-post-deploy-drush@v4.0.0-beta.1
         with:
           site: ${{ inputs.pantheon_site }}
           env: dev
-          machine_token: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
+          machine_token: ${{ env.PANTHEON_MACHINE_TOKEN }}
           skip: ${{ inputs.workflow_skip_terminus }}
           pr_title: ${{ github.event.pull_request.title }}
 
       - name: Get environment URL
         id: env_url
         env:
-          TERMINUS_MACHINE_TOKEN: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
+          TERMINUS_MACHINE_TOKEN: ${{ env.PANTHEON_MACHINE_TOKEN }}
           SITE: ${{ inputs.pantheon_site }}
         run: |
           URL=$(terminus env:view "${SITE}.dev" --print)
@@ -207,9 +220,21 @@ jobs:
     if: ${{ always() && inputs.slack_channel }}
     runs-on: ubuntu-latest
     steps:
+      - name: Configure 1Password
+        uses: 1password/load-secrets-action/configure@v2
+        with:
+          service-account-token: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
+
+      - name: Load secrets
+        uses: 1password/load-secrets-action@v2
+        with:
+          export-env: true
+        env:
+          SLACK_BOT_TOKEN: op://s360-cicd/slack/bot-token
+
       - name: Send Slack notification
         env:
-          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+          SLACK_BOT_TOKEN: ${{ env.SLACK_BOT_TOKEN }}
           SLACK_CHANNEL: ${{ inputs.slack_channel }}
           SEMANTIC_RESULT: ${{ needs.semantic_release.result }}
           DEPLOY_RESULT: ${{ needs.deploy_to_pantheon_dev.result }}