Provide access to secrets at runtime in GitHub Actions (public preview)

1Password Credential Broker sits between your GitHub Actions workflows and your credentials, supplying secrets at runtime only after confirming a workflow’s identity. Secrets are only available for the duration of the job, and every request for access is recorded in your audit log. To get started, an administrator must connect your organization’s 1Password Business account to your GitHub organization. Developers can then configure a 1Password Enviroment to use in GitHub Actions workflows for repositories within the connected GitHub organization.

Requirements

Before you begin, an administrator must follow these steps to connect your organization’s 1Password Business account to your GitHub organization hosted on GitHub.com. GitHub organizations hosted on GitHub Enterprise Server or GitHub Enterprise Cloud with data residency aren’t currently supported.

Sign in on 1Password.com, then select Developer in the sidebar.
Select Set up an integration, then select GitHub Actions.
If you’ve already added a GitHub organization and want to add another, select Manage integration, then select Add Integration.
Enter a name for the integration and the name of the organization you want to connect, then select Create integration.
Add the OP_INTEGRATION_KEY name and token value to the list of secrets in your GitHub organization.

After your GitHub organization is connected, make sure you’ve installed the 1Password desktop app, then update to the latest version before you continue to step 1.

Step 1: Create an Environment

To configure the variables you want to use in a GitHub Actions workflow, create a new 1Password Environment with your variables or add the variables to an existing Environnment.

Step 2. Configure the GitHub Actions destination

After you’ve created an Environment and added your secrets, you can add the GitHub Actions destination to your Environment:

In your Environment, select the Destinations tab, then select Configure destination for GitHub Actions.
If you’ve already configured a destination for your Environment, select New destination instead.
Select the integration field, then choose the integration for the GitHub organization you need.
Enter the name of the repository where your workflow needs to run.
(Optional) Specify if you want to restrict access to a specific GitHub Actions workflow, environment, or branch in your repository.
Select Add destination.

Step 3: Update your GitHub Actions workflow

After you’ve added the GitHub Actions destination to your Environment, copy the snippet from the 1Password desktop app and include it in a GitHub Actions workflow in order to reference any secrets in your Environment. You can choose from two methods to reference variables in your workflow:

If you add a unique identifier to the step you copied into your workflow, you can reference the variables with the following structure: ${{ steps.<id>.outputs.<variable-name> }}
If you include export-env: "true" as an import parameter to the step you copied into your workflow, you can reference the variables with the following structure: ${{ env.<variable-name> }}

The specific steps you will need to follow will vary depending on your workflow setup. Refer to the GitHub Actions documentation for more information on how to use workflows.

Usage example

The following example shows how to use 1Password Credential Broker to load a username and token variable from an Environment, then use them to log into Docker Hub.

config.yml

on: push
name: Deploy app

jobs:
  test:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: actions/checkout@v3

      - name: Load Docker credentials
        id: load-docker-credentials
        uses: 1password/load-secrets-action@v5beta
        env:
          OP_WORKLOAD_ID: <your-workload-id>
          OP_ENVIRONMENT_ID: <your-environment-id>
          OP_INTEGRATION_KEY: ${{ secrets.OP_INTEGRATION_KEY }}

      - name: Login to Docker Hub
        uses: docker/login-action@v1
        with:
          username: ${{ steps.load-docker-credentials.outputs.DOCKERHUB_USERNAME }}
          password: ${{ steps.load-docker-credentials.outputs.DOCKERHUB_TOKEN }}

      - name: Build and push Docker image
        uses: docker/build-push-action@v2
        with:
          push: true
          tags: acme/app:latest

Get help

If you don’t see GitHub Actions as a destination in the 1Password desktop app, make sure your administrator has connected your GitHub organization to your 1Password account. If you see an OIDC-related error in your workflow log in GitHub, make sure you have id-token: write set in the permissions within your workflow. . This permission allows GitHub to generate a short-lived token that 1Password uses to identify your workflow before suppling your secrets at runtime.

Environments (beta)

Provide access to secrets at runtime in GitHub Actions (public preview)

Requirements

Step 1: Create an Environment

Step 2. Configure the GitHub Actions destination

Step 3: Update your GitHub Actions workflow

Usage example

Get help

Learn more

​Requirements

​Step 1: Create an Environment

​Step 2. Configure the GitHub Actions destination

​Step 3: Update your GitHub Actions workflow

​Usage example

​Get help

​Learn more

Requirements

Step 1: Create an Environment

Step 2. Configure the GitHub Actions destination

Step 3: Update your GitHub Actions workflow

Usage example

Get help

Learn more