GHA to Read Notes from 1Password Note and Push to GitHub Secrets

1pw.yaml

name: Set GitHub Secrets

on:
  workflow_dispatch:
    inputs:
      repo:
        description: "Select the Git repository"
        type: choice
        required: true
        options:
          - foo_project
          - bar_project

      environment:
        description: "Select the environment or repo"
        type: choice
        default: "dev"
        options:
          - dev
          - staging
          - prod
          - repo

env:
  VAULT: "set_github_secrets"
  GITHUB_REPO_OWNER: "clarkritchie"
  DEBUG: "true"

jobs:
  set-secrets-from-1pw:
    name: Read Secure Notes from 1Password and Push to GitHub Environments
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Configure 1Password Service Account
        uses: 1password/load-secrets-action/configure@v1
        with:
          # Persist the 1Password Service Account Authorization token
          # for next steps.
          # Keep in mind that every single step in the job is now
          # able to access the token.
          service-account-token: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}

      - name: Install 1Password CLI
        uses: 1password/install-cli-action@v1

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'
          cache: 'pip'

      - name: Install Dependencies
        run: pip3 install -r requirements.txt

      - name: Export Secure Note ${{ inputs.repo }}_${{ inputs.environment }} From Vault ${{ env.VAULT }}
        id: get-note
        run: |
          FILE=$(mktemp)
          op read --out-file ${FILE} --force "op://${{ env.VAULT }}/${{ inputs.repo }}_${{ inputs.environment }}/notesPlain" > /dev/null
          echo "file=${FILE}" >> $GITHUB_OUTPUT

      - name: Create git.env File
        run: |
          echo GITHUB_ACCESS_TOKEN=${{ secrets.MY_BOT_PAT }} > git.env
          echo GITHUB_REPO_OWNER=${{ env.GITHUB_REPO_OWNER }} >> git.env

      - name: Push to ${{ github.event.inputs.repo }}/${{ github.event.inputs.environment }}
        run: |
          ENVIRONMENT=${{ github.event.inputs.environment }} GITHUB_REPO=${{ github.event.inputs.repo }} ENV_FILE=${{ steps.get-note.outputs.file }} python3 -u main.py silent