install-cli-action: Add Docker Hub fallback for CLI version resolution

.github/workflows/check-fallback-versions.yml

@@ -0,0 +1,24 @@
+on:
+  push:
+    branches: ["release/**"]
+name: Check fallback versions are fresh
+
+# Runs when a release branch is created/updated to check pinned CLI version
+jobs:
+  check-fallback-versions:
+    name: "Check baked-in fallback versions are up to date"
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 24
+      - run: npm ci
+      - name: Regenerate fallback versions
+        run: npm run op-version
+      - name: Fail if fallback-versions.ts is stale
+        run: |
+          if ! git diff --exit-code src/op-cli-installer/version/fallback-versions.ts; then
+            echo "::error::fallback-versions.ts is out of date. Run 'npm run op-version' and commit the result on this release branch."
+            exit 1
+          fi

.github/workflows/test.yml

@@ -56,3 +56,66 @@ jobs:
           version: 2.19.0-beta.01
       - name: Check CLI version
         run: ./test/assert-version.sh 2.19.0-beta.01
+  use-docker-hub-fallback:
+    name: "Test Docker Hub fallback when app-updates is unavailable"
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        include:
+          - channel: latest
+            versionPath: .CLI2.release.version
+          - channel: latest-beta
+            versionPath: .CLI2.beta.version
+    steps:
+      - uses: actions/checkout@v6
+      - name: Capture expected ${{ matrix.channel }} version from app-updates
+        id: expected
+        run: |
+          version=$(curl -s https://app-updates.agilebits.com/latest | jq -r '${{ matrix.versionPath }}')
+          echo "Expected ${{ matrix.channel }} version: $version"
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+      # Blackhole only app-updates.agilebits.com. The download CDN (cache.agilebits.com)
+      # and Docker Hub stay reachable, so the primary source fails but the fallback works.
+      - name: Simulate an app-updates.agilebits.com outage
+        run: echo "127.0.0.1 app-updates.agilebits.com" | sudo tee -a /etc/hosts
+      - name: Install 1Password CLI (must resolve via the Docker Hub fallback)
+        uses: ./ # 1password/install-cli-action@<version>
+        with:
+          version: ${{ matrix.channel }}
+      - name: Assert the fallback resolved the same version app-updates would have
+        run: ./test/assert-version.sh "${{ steps.expected.outputs.version }}"
+      - name: Restore app-updates resolution
+        if: always()
+        run: sudo sed -i '/app-updates.agilebits.com/d' /etc/hosts
+  use-baked-in-fallback:
+    name: "Test baked-in fallback when app-updates and Docker Hub are unavailable"
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        include:
+          - channel: latest
+            key: latest
+          - channel: latest-beta
+            key: latestBeta
+    steps:
+      - uses: actions/checkout@v6
+      - name: Read expected baked-in ${{ matrix.channel }} version
+        id: expected
+        run: |
+          version=$(grep "ReleaseChannel.${{ matrix.key }}]" src/op-cli-installer/version/fallback-versions.ts | grep -oE '"[^"]+"' | tr -d '"')
+          echo "Expected baked-in ${{ matrix.channel }} version: $version"
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+      # Blackhole both live sources so resolution must fall through to the pinned version
+      - name: Simulate an app-updates and Docker Hub outage
+        run: |
+          echo "127.0.0.1 app-updates.agilebits.com" | sudo tee -a /etc/hosts
+          echo "127.0.0.1 hub.docker.com" | sudo tee -a /etc/hosts
+      - name: Install 1Password CLI (must resolve via the baked-in fallback)
+        uses: ./ # 1password/install-cli-action@<version>
+        with:
+          version: ${{ matrix.channel }}
+      - name: Assert the baked-in version was installed
+        run: ./test/assert-version.sh "${{ steps.expected.outputs.version }}"
+      - name: Restore resolution
+        if: always()
+        run: sudo sed -i '/app-updates.agilebits.com/d;/hub.docker.com/d' /etc/hosts