PR Custody

PRPR Custody

[codex] fix 1Password service-account auth

@sjd9021checks n/achecks…codex/onepassword-cli-service-account → master13 files · +1562 −177updated 3w ago

GitHub

▸Description

Summary

replace the 1Password Python SDK path with op CLI service-account execution
restrict auth config to ops_* service account tokens and remove Connect/Event API fields
install 1Password CLI in Lambda/local Lambda images and remove onepassword-sdk from Python deps
add focused tests for CLI env handling, token validation, template-file secret handling, and bundled-module PATH fallback

Root Cause

The 1Password SDK Linux wheels require a newer glibc than the Lambda runtime provides, causing native import failures before actions can run. The supported headless path for these actions is the 1Password CLI with OP_SERVICE_ACCOUNT_TOKEN.

Validation

.venv/bin/python -m compileall -q apps/_1password tests/test_apps/test_1password
.venv/bin/pytest tests/test_apps/test_1password/test_cli_adapter.py -q
.venv/bin/nox -s chk_app -- apps/_1password
real 1Password smoke test: create vault, list vaults, create/list/get/update/delete item, cleanup vault
bundled-source smoke test for ListVaults through Mercury portable bundle loading

Not Run

Lambda Docker image runtime test: Docker daemon was not running locally
make validate-config file=apps/_1password/config.ts: local JS deps are missing @composiohq/auth-config across configs

loading diff…