Improve supply chain security and fix secret sync command#10
Merged
Conversation
Pin 1password/install-cli-action to commit SHA (v2.0.2) for supply chain security. Remove erroneous --body - flag from gh secret set which passed the literal string "-" instead of reading piped stdin. https://claude.ai/code/session_01SvzkZUEyQnbHgMWodBoq65
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR improves the security posture of the 1Password secret sync action and fixes a bug in the secret synchronization command.
Key Changes
Pin 1Password CLI action to commit SHA: Updated the
1password/install-cli-actiondependency from a floating version tag (v2) to a pinned commit SHA (9a0c9dd934086b7ab1d90115d455bda1c53c2bdb) with a comment indicating the version (v2.0.2). This prevents supply chain attacks by ensuring the exact version of the action is used rather than allowing automatic updates.Fix
gh secret setcommand: Removed the--body -flags from thegh secret setcommand. The--body -syntax is not a valid option for this command and was causing the secret synchronization to fail. The corrected command now properly sets secrets without these invalid flags.Implementation Details
gh secret setcommand now relies on standard input piping (viaecho "$value" |) without explicit flags, which is the correct usage patternhttps://claude.ai/code/session_01SvzkZUEyQnbHgMWodBoq65