Skip to content

fix(prep-airdrop): guard against service account token in environment #26

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
smartwatermelon merged 1 commit into from
Apr 12, 2026
Merged

fix(prep-airdrop): guard against service account token in environment #26

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions prep-airdrop.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -138,6 +138,17 @@ echo "Validating configuration..."
: "${ONEPASSWORD_TIMEMACHINE_ITEM:?ONEPASSWORD_TIMEMACHINE_ITEM must be set in config.conf}"
: "${ONEPASSWORD_APPLEID_ITEM:?ONEPASSWORD_APPLEID_ITEM must be set in config.conf}"

# Guard: this script requires interactive 1Password authentication to access
# the Personal vault. The service account token (set in ~/.config/bash/1password.sh)
# only has access to the Automation vault.
# Use 'opp' as a drop-in replacement: opp item get "TimeMachine" --vault personal
if [[ -n "${OP_SERVICE_ACCOUNT_TOKEN:-}" ]]; then
echo "ERROR: OP_SERVICE_ACCOUNT_TOKEN is set — this script requires interactive 1Password auth." >&2
echo "Run with 'opp' prefix for personal vault access, or use a subshell:" >&2
echo " ( unset OP_SERVICE_ACCOUNT_TOKEN; ./$(basename "$0") )" >&2
exit 1
fi

# Handle command line arguments
if [[ "${1:-}" == "--help" ]] || [[ "${1:-}" == "-h" ]]; then
echo "Usage: $(basename "$0") [output_path] [script_path]"
Expand Down
Loading