rfc: 1Password CLI secret injection - #127
Open
BoldBlackBot wants to merge 1 commit into
Open
Conversation
BoldBlackBot
force-pushed
the
rfc/1password-secret-injection
branch
3 times, most recently
from
August 3, 2026 13:31
53fa79d to
b16704f
Compare
BoldBlackBot
force-pushed
the
rfc/1password-secret-injection
branch
2 times, most recently
from
August 11, 2026 13:31
1be3c3d to
82d9cb2
Compare
Add an RFC proposing host-side resolution of 1Password secret references (op://vault/item/field) in env files, so secrets like GH_TOKEN and provider API keys no longer need to sit in plaintext .env files on disk. Documents why the op desktop-app socket cannot cross the container boundary and recommends Option A (host-side resolution) over in-container service-account/Connect auth to keep the vault token off the container's attack surface. Co-authored-by: Julio Capote <capotej@users.noreply.github.com>
BoldBlackBot
force-pushed
the
rfc/1password-secret-injection
branch
from
August 11, 2026 21:31
82d9cb2 to
7b0a852
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds
rfcs/2026-07-15_1password-secret-injection.md— an RFC proposing that harness resolve 1Password secret references (op://vault/item/field) in env files, so secrets likeGH_TOKENand provider API keys no longer need to sit in plaintext.envfiles on disk.Can
opreach the host vault from the container?No — the 1Password desktop-app integration uses a local IPC socket that does not cross the container boundary. This is a documented 1Password limitation. The RFC covers the two container-compatible auth modes (service-account token, and 1Password Connect) and explains why the socket path is a non-starter.
Design
The RFC analyzes two structurally different resolution points and recommends one:
op://references on the host at launch time (using the hostopCLI, which can use desktop integration), writes resolved values to amktemp+chmod 600temp file, passes it into the container via the existing--env-fileflow, and scrubs it after start. No image/entrypoint change; the vault token never enters the container. Degrades gracefully — noop://references → noopneeded on the host.opdependency.Why
Plaintext
.envfiles on disk are an accidental-commit and supply-chain-exfiltration risk (postinstallscripts, MCP servers, and agents all run arbitrary code with read access to the workspace). Storing the reference instead of the value makes the on-disk file useless to an attacker.What changed
rfcs/2026-07-15_1password-secret-injection.md(new) — the RFC.No code, image, or entrypoint changes; this is a proposal for review. Lints clean against the repo
markdownlint-cli2config.Checklist
rfcs/YYYY-MM-DD_short_title.md)pnpm lint:mdpasses (0 errors)