lfreleng-actions/🔐 Credential Load Action
Retrieves a project/repository specific credential from a 1Password vault
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 9, 2026
- License
- None
Pinned Snippet
uses: lfreleng-actions/credential-load-action@ce4a30074c03595ce0799fa09a00887ed1bffdd5 # v2.0.1tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| op_service_account_token | 1Password service account token | yes | — |
| vault_mapping_json | JSON mapping repository owner to 1Password vault; accepts the JSON base64 encoded (preferred, avoids degraded log redaction) or as plain JSON | yes | — |
| credential_name | Explicit 1Password item name; overrides the derived repository name (e.g. Gerrit project 'sdc/onap-ui-common' stored as 'sdc-onap-ui-common'). Overrides naming a different item than the repository's own name require a matching grant in credential_grants_json | no | "" |
| credential_grants_json | JSON array of credential item names this repository may load via credential_name (e.g. '["sdc-onap-ui-common"]'). Wire this from the administrator-controlled CREDENTIAL_LOAD_GRANTS repository variable; project teams without repository administration rights cannot set it themselves | no | "" |
| export_env | Export credential as CREDENTIAL env var for all later steps ('true'/'false') | no | false |
| checkout | Check out the repository as part of this action ('true'/'false'). The action needs no repository files itself, so the checkout is off by default; it resets and cleans the workspace, discarding untracked files and any non-default checkout (e.g. a Gerrit change or downloaded artefacts). Set 'true' only when a later step needs the default branch checked out and the job performs no checkout of its own | no | false |
Outputs
| name | description |
|---|---|
| credential | Loaded credential; populated only when 'export_env' is 'false' |