Add fallback for 1Password /latest endpoint outages in setup-certificate-1p#93
Conversation
…ate-1p Mirror the resolve-version-then-install pattern from setupGitForOSBotify. 1password/install-cli-action hits app-updates.agilebits.com/latest to resolve "latest" to a concrete version. When that endpoint degrades, every workflow that calls setup-certificate-1p (App/buildIOS, buildAndroid, androidBump, Web-Expensify tests, Web-Secure, Auth, FuzzyBot) fails at the install step with an opaque JSON parse or ConnectTimeout error. Resolve the version ourselves in a pre-flight step and fall back to scraping the S3-backed changelog at releases.1password.com when the primary resolver is down. Pass the concrete version to install-cli-action so it skips the flaky endpoint and downloads straight from cache.agilebits.com.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 19e3e6d22a
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
sort -V is GNU-only; macOS BSD sort does not support it. This composite action runs on macOS runners (e.g. App iOS deploys on blacksmith-12vcpu-macos-latest), so the changelog-scrape fallback would silently produce an empty version there. Switch to a POSIX numeric sort across the three dotted fields.
|
@codex review |
|
Codex Review: Didn't find any major issues. 🎉 Reviewed commit: ℹ️ About Codex in GitHubCodex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback". |
2 participants
Details
Follow-up to #84, which added the same fallback to
setupGitForOSBotify. Georgia flagged in that PR thatsetup-certificate-1p/action.ymlhas the same vulnerability, and confirmed evidence exists — Ionatan hit it in an Auth PR on 2026-04-09 during a/latestoutage:(Auth run 24194818059 / job 70625239693) — the SHA in that stack trace matches the install-cli-action pinned in
setup-certificate-1p/action.yml:17exactly.Callers that hit this action independently of
setupGitForOSBotify(i.e. would fail even after #84):buildIOS,buildAndroid,androidBump, variousdeployjobsweb-expensify,agent-zero-full-suite,agent-zero-targeted-tests,failure-rate-reportweb-secureauthfuzzybotApplying the same pattern here: pre-flight resolve step with S3 changelog fallback, then pass a concrete
version:toinstall-cli-actionso the flaky endpoint is skipped entirely.Related Issues
n/a — infra resilience, no linked issue
Manual Tests
curl -sSf https://app-updates.agilebits.com/latest | jq -r '.CLI2.release.version'returns the current version when the endpoint is healthy.2.35.0(the actual latest release):id="1password-cli-X.Y.Z"headings avoids false matches on SVG path coordinates elsewhere on the page (a loose\b2\.[0-9]+\.[0-9]+\bregex picks up2.85714286.0from SVG data). Sort uses POSIX numeric key sort across the three dotted fields so it works on macOS BSDsort(no-V).version:skips the flaky endpoint and downloads straight fromcache.agilebits.com.Once merged, the next run of any caller workflow will exercise the primary path end-to-end.
Linked PRs
setupGitForOSBotify/action.yml