[ghughes610]

Human PR description:

Ben Wilson has changed the way developers will interact with qrsensor_vertiv_production. We use to use api keys that were shared/stored in our 1password. The issue became some keys leaked into the qrsensor_vertiv_production.

On 11/10/26 Ben Wilson created a way for the devs to interact with that repo in a safer way (Dave Thomas is working on an elixir rebuild currently called QRS). In the meantime, we are going to start using personal access tokens generated by the app.qrsensor.com system. The changes can be seen here:

https://github.com/CargoSense/qrsensor_vertiv_production/pull/47
https://github.com/CargoSense/qrsensor_vertiv_production/pull/63

My understanding (very superficial) of the way these repos (devcontainers-features + workspace) interact is that when the workspace dev container builds it looks at the devcontainers-features repo to see which install script to run. This is why we need two PRs for this.

I to test this I included the automated test but I also did all of this locally paired with Bens changes and the script he created worked.

Here is the second PR for workspace. (https://github.com/CargoSense/workspace/pull/90)

🧗 Generated by Greg Hughes

Robot PR description is below because this is all very new to me.

Adds a 1password-cli Feature that installs the 1Password CLI (op) into a dev container:

"features": {
  "ghcr.io/CargoSense/devcontainer-features/1password-cli:1": {}
}

Why

Some of our dev containers need op to run scripts that read or store credentials in 1Password. Publishing it here means any container gets it with one line instead of carrying its own copy of the install script.

How

src/1password-cli/install.sh follows 1Password's Linux install guide for Debian/Ubuntu:

• adds 1Password's apt repository, pinned to its signing key (signed-by)
• installs the debsig policy and keyring, so the package signature is verified
• installs 1password-cli, then prints op --version

It follows the conventions of the existing Features: it refuses to run as non-root, and it removes curl or gpg again if it had to install them. It has no options and installs the latest package, on amd64 and arm64.

The Feature README explains signing in. The desktop app's CLI integration does not reach into a container, so op signs in with op account add once, then eval "$(op signin)" per terminal, and a named volume on ~/.config/op keeps the account across rebuilds.

Tests

• test/1password-cli/test.sh checks that op --version runs and that op is at /usr/bin/op.
• 1password-cli is added to the test.yml matrix, so it is installed and tested on the Debian and Ubuntu base images.
• shellcheck (repo config, all optional checks) and Feature JSON validation pass.

After merge

release.yml publishes the Feature to ghcr.io/cargosense/devcontainer-features/1password-cli. A follow-up PR then switches the first consumer's devcontainer.json to it.

🤖 Generated with Claude Code