install-cli-action: Add Docker Hub fallback for CLI version resolution

[JillRegan]

Summary

Resolving the latest CLI version currently depends on a single request to app-updates.agilebits.com. When that endpoint has an outage the action fails and breaks users' CI.

This adds two fallback tiers so version resolution survives an outage:

1. app-updates (unchanged primary)
2. Docker Hub the 1password/op image tags, on separate infrastructure
3. Baked-in versions a pinned constant refreshed at release time

If a tier fails, resolution falls through to the next. The action should not fail as final constant is pinned version.

How

• getLatestVersion now tries app-updates first and falls back to the Docker Hub tags API.
• Docker Hub returns all tags, so the fallback filters to the requested channel (N.N.N for stable, N.N.N-beta.N for beta) and picks the highest version. Beta tags aren't valid semver (leading zero), so they're normalized only for comparison and returned unchanged.
• Baked-in tier: src/op-cli-installer/version/fallback-versions.ts holds the last known stable and beta versions, regenerated from app-updates via npm run op-version (run at release time, see release instructions).

Testing

• Unit tests cover primary success.
• Two E2E jobs (matrixed over latest and latest-beta) blackhole hosts via /etc/hosts and verify the correct version still installs:
  • use-docker-hub-fallback app-updates down → resolves via Docker Hub.
  • use-baked-in-fallback app-updates and Docker Hub down → resolves via the baked in constant.

In the E2E test here you can see the warning that we fell back to Docker and successfully resolved the correct version.

Run ./
Validating version number: 'latest-beta'
Version number 'latest-beta' is valid
Resolving version: latest-beta
Getting latest-beta version number
Warning: Could not resolve latest-beta version from app-updates.agilebits.com (TypeError: fetch failed); falling back to Docker Hub
Downloading 1Password CLI from: https://cache.agilebits.com/dist/1P/op2/pkg/v2.37.0-beta.01/op_linux_amd64_v2.37.0-beta.01.zip
Installing 1Password CLI
/usr/bin/unzip -o -q /home/runner/work/_temp/730b458f-e29e-4705-8091-7c7a28d6be41
Verifying 1Password CLI signature
1Password CLI signature verified
1Password CLI installed

In the E2E test here you can see the warning that we fell back to pinned version and successfully resolved the correct version.

Run ./
Validating version number: 'latest-beta'
Version number 'latest-beta' is valid
Resolving version: latest-beta
Getting latest-beta version number
Warning: Could not resolve latest-beta version from app-updates.agilebits.com (TypeError: fetch failed); falling back to Docker Hub
Warning: Could not resolve latest-beta version from Docker Hub (TypeError: fetch failed); using the version baked in at build time
Downloading 1Password CLI from: https://cache.agilebits.com/dist/1P/op2/pkg/v2.37.0-beta.01/op_linux_amd64_v2.37.0-beta.01.zip
Installing 1Password CLI
/usr/bin/unzip -o -q /home/runner/work/_temp/1b9fe928-a53b-4f68-b376-72e8a88b91be
Verifying 1Password CLI signature
1Password CLI signature verified
1Password CLI installed