reuse-one-password.yaml

---
# SPDX-License-Identifier: Apache-2.0
# SPDX-FileCopyrightText: 2024 The Linux Foundation

# Validates 1Password vault access given a service account
name: "🔑 [R] 1Password"

on:
  workflow_call:
    inputs:
      # Required inputs
      VAULT_ITEM:
        description: "Element to load from 1Password using service account"
        required: false
        type: string
      # Optional inputs
      ACCESS_TYPE:
        description: "Descriptive label for vault access, e.g. [ development|production|none ]"
        required: false
        type: string
        default: "none"
      EXPORT:
        description: "Export vault element to environment/subsequent steps"
        required: false
        default: false
        type: boolean

    # Service account credentials
    secrets:
      ONE_PASSWORD_DEVELOPMENT:
        description: "1Password service account [ Development ]"
        required: false
      ONE_PASSWORD_PRODUCTION:
        description: "1Password service account [ Production ]"
        required: false

permissions: {}

jobs:
  one-password:
    name: "Vault access"
    runs-on: "ubuntu-24.04"
    # Does not need to interact with GitHub not the repository at all
    permissions: {}
    steps:
      - name: "Validate 1Password workflow inputs"
        # This is necessary, as most inputs are NOT mandatory
        # However, we do NOT want this workflow to fail/block others
        shell: bash
        run: |
          # Validate 1Password workflow inputs
          if [ -z "${{ inputs.vault_item }}" ] && [ "${{ inputs.access_type }}" != 'none' ]; then
            echo "Error: vault item is required unless access_type set to none"
            exit 1
          fi

      - name: "Use Service Account [ Development ]"
        uses: 1password/load-secrets-action@581a835fb51b8e7ec56b71cf2ffddd7e68bb25e0 # v2.0.0
        if: inputs.ACCESS_TYPE == 'development'
        with:
          # Export loaded secrets as environment variables
          export-env: ${{ inputs.export }}
        env:
          VAULT_ITEM: ${{ inputs.vault_item }}
          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.one_password_development }}

      - name: "Use Service Account [ Production ]"
        uses: 1password/load-secrets-action@581a835fb51b8e7ec56b71cf2ffddd7e68bb25e0 # v2.0.0
        if: inputs.ACCESS_TYPE == 'production'
        with:
          # Export loaded secrets as environment variables
          export-env: ${{ inputs.export }}
        env:
          VAULT_ITEM: ${{ inputs.vault_item }}
          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.one_password_production }}

      # Prints masked secret value: ***
      - name: "Test masked output value"
        if: inputs.ACCESS_TYPE == 'development'
        run: |
          # Test masked output value
          echo "Element loaded as variable: $VAULT_ITEM"
          echo "export-env was set to: ${{ inputs.export }}"

      - name: "Print summary to job output"
        run: |
          # Print summary to job output
          # shellcheck disable=SC2129

          echo "# 🔑 1Password Service" >> "$GITHUB_STEP_SUMMARY"

          echo "Availability of credentials and service accounts to this workflow run" \
            >> "$GITHUB_STEP_SUMMARY"

          echo "| Status | Account Type |" >> "$GITHUB_STEP_SUMMARY"
          echo "| ------ | ---------------------|" >> "$GITHUB_STEP_SUMMARY"
          if [ -z "${{ secrets.one_password_development }}" ]; then
            echo "| ❌ | Development Service Account |" >> "$GITHUB_STEP_SUMMARY"
          else
            echo "| ✅ | Development Service Account |" >> "$GITHUB_STEP_SUMMARY"
          fi
          if [ -z "${{ secrets.one_password_production }}" ]; then
            echo "| ❌ | Production Service Account |" >> "$GITHUB_STEP_SUMMARY"
          else
            echo "| ✅ | Production Service Account |" >> "$GITHUB_STEP_SUMMARY"
          fi