Adds support for fetching secrets from 1Password Environments

[notnek]

Through a new environment option, define your 1Password Environment's ID to either fetch all secrets or specific secrets from an environment. Resolves #1907.

kamal secrets fetch --adapter 1password --environment <id>

kamal secrets fetch --adapter 1password --environment <id> SECRET_KEY_BASE

[Copilot]

Pull request overview

Adds 1Password Environment support to secret fetching.

Changes:

• Adds the --environment CLI option.
• Reads all or selected environment variables.
• Adds environment fetching and authentication tests.

Tip

If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
lib/kamal/cli/secrets.rb	Exposes and forwards the environment option.
lib/kamal/secrets/adapters/base.rb	Extends the adapter fetch interface.
lib/kamal/secrets/adapters/one_password.rb	Implements Environment reads and filtering.
test/secrets/one_password_adapter_test.rb	Tests Environment fetching and sessions.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

Suppressed comments (1)

lib/kamal/secrets/adapters/one_password.rb:10

• Supplying both source selectors currently makes --environment silently override --from; with no secret names this can return the entire environment even though the caller supplied a narrower vault source. Reject the mutually exclusive options explicitly instead of silently discarding one.

    fetch_secrets(secrets, from: from, environment: environment, account: account, session: session)

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Suppressed comments (2)

Previously missed (2) — in code that hasn't changed since the last review.

lib/kamal/secrets/adapters/one_password.rb:13

• This override no longer satisfies the adapter interface: Base#requires_account? takes no arguments, so generic callers that invoke requires_account? directly now get ArgumentError. Making the environment argument optional preserves the existing contract while still allowing the CLI to pass environment context.

  def requires_account?(environment)

lib/kamal/secrets/adapters/one_password.rb:5

• --environment and --from select different sources, but when both are supplied the environment branch silently ignores --from. Rejecting this conflicting combination prevents a typo or stale option from fetching secrets from the wrong source.

  def fetch(secrets, account: nil, from: nil, environment: nil)
    raise RuntimeError, "Missing required option '--account'" if requires_account?(environment) && account.blank?

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

Suppressed comments (1)

lib/kamal/cli/secrets.rb:11

• Validate adapter support before checking its account requirement. As written, an unsupported call such as --adapter bitwarden --environment asdf without --account reports that the account is missing instead of rejecting --environment; the intended error only appears after the user supplies an otherwise irrelevant account.

    if adapter_requires_account?(adapter) && options[:account].blank?

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.