lfreleng-actions/🔐 Credential Load Action

Retrieves a project/repository specific credential from a 1Password vault

View on GitHub

Trust Signals

Scorecard Score
not yet scored
Maintenance Recency
Activelast commit Jul 9, 2026
License
None

Pinned Snippet

workflow.ymlSHA-pinned
uses: lfreleng-actions/credential-load-action@ce4a30074c03595ce0799fa09a00887ed1bffdd5 # v2.0.1

tags can be moved; commit SHAs can't. why a SHA?

namedescriptionrequireddefault
op_service_account_token1Password service account tokenyes
vault_mapping_jsonJSON mapping repository owner to 1Password vault; accepts the JSON base64 encoded (preferred, avoids degraded log redaction) or as plain JSONyes
credential_nameExplicit 1Password item name; overrides the derived repository name (e.g. Gerrit project 'sdc/onap-ui-common' stored as 'sdc-onap-ui-common'). Overrides naming a different item than the repository's own name require a matching grant in credential_grants_jsonno""
credential_grants_jsonJSON array of credential item names this repository may load via credential_name (e.g. '["sdc-onap-ui-common"]'). Wire this from the administrator-controlled CREDENTIAL_LOAD_GRANTS repository variable; project teams without repository administration rights cannot set it themselvesno""
export_envExport credential as CREDENTIAL env var for all later steps ('true'/'false')nofalse
checkoutCheck out the repository as part of this action ('true'/'false'). The action needs no repository files itself, so the checkout is off by default; it resets and cleans the workspace, discarding untracked files and any non-default checkout (e.g. a Gerrit change or downloaded artefacts). Set 'true' only when a later step needs the default branch checked out and the job performs no checkout of its ownnofalse
namedescription
credentialLoaded credential; populated only when 'export_env' is 'false'