load-secrets-action: Add Docker Hub fallback for CLI version resolution

[JillRegan]

Summary

Resolving the latest CLI version currently depends on a single request to app-updates.agilebits.com. When that endpoint has an outage the action fails and breaks users' CI.

This adds two fallback tiers so version resolution survives an outage:

1. app-updates (unchanged primary)
2. Docker Hub the 1password/op image tags, on separate infrastructure
3. Baked-in versions a pinned constant refreshed at release time

If a tier fails, resolution falls through to the next. The action should not fail as final constant is pinned version.

How

• getLatestVersion now tries app-updates first and falls back to the Docker Hub tags API.
• Docker Hub returns all tags, so the fallback filters to the requested channel (N.N.N for stable, N.N.N-beta.N for beta) and picks the highest version. Beta tags aren't valid semver (leading zero), so they're normalized only for comparison and returned unchanged.
• Baked-in tier: src/op-cli-installer/version/fallback-versions.ts holds the last known stable and beta versions, regenerated from app-updates via npm run op-version (run at release time, see release instructions).

Testing

• Unit tests cover primary success.
• Two E2E jobs (matrixed over latest and latest-beta) blackhole hosts via /etc/hosts and verify the correct version still installs

In the E2E test here you can see the warning that we fell back to Docker and successfully resolved the correct version.

Run ./
Authenticated with Service account.
Validating version number: 'latest-beta'
Version number 'latest-beta' is valid
Resolving version: latest-beta
Getting latest-beta version number
Warning: Could not resolve latest-beta version from app-updates.agilebits.com (TypeError: fetch failed); falling back to Docker Hub
Downloading 1Password CLI from: https://cache.agilebits.com/dist/1P/op2/pkg/v2.37.0-beta.01/op_linux_amd64_v2.37.0-beta.01.zip
Installing 1Password CLI

In the E2E test here you can see the warning that we fell back to pinned version and successfully resolved the correct version.

Run ./
Authenticated with Service account.
Validating version number: 'latest'
Version number 'latest' is valid
Resolving version: latest
Getting latest version number
Warning: Could not resolve latest version from app-updates.agilebits.com (TypeError: fetch failed); falling back to Docker Hub
Warning: Could not resolve latest version from Docker Hub (TypeError: fetch failed); using the version baked in at build time
Downloading 1Password CLI from: https://cache.agilebits.com/dist/1P/op2/pkg/v2.35.0/op_linux_amd64_v2.35.0.zip
Installing 1Password CLI
/usr/bin/unzip -o -q /home/runner/work/_temp/1006306c-ee30-4fa0-aede-157834c4ef70
1Password CLI installed

⚠️ Note for Reviewer

I also refactored the E2E test setup. E2E tests for the action were redundant and flakey and often led to rate limiting issues on the test account (these tests had ~200 read requests each run). There was no need to be testing that many different combinations of the same read so i refactored to reduce it to around 30 reads. The following now runs:

Service Account (ubuntu, latest, export-env=false)
Service Account (ubuntu, latest, export-env=true)
Service Account smoke (macOS, latest)
Service Account smoke (Windows, latest)
Connect (ubuntu, latest)
Install pinned CLI (ubuntu, 2.30.0)
Docker Hub fallback (ubuntu, latest)
Docker Hub fallback (ubuntu, latest-beta)
Baked-in fallback (ubuntu, latest)
Baked-in fallback (ubuntu, latest-beta)

[scottisloud]

No feedback to add beyond what Bert's already flagged!