GitHub Action that installs a specific version of the SOPS binary on the runner.

Repurposed from Azure/setup-helm.

- name: Install SOPS
  uses: mdgreenwald/mozilla-sops-action@v2.1.1
  with:
     version: 'v3.13.1' # default is latest stable
  id: install

Acceptable values for version:

• latest (default) — queries the GitHub releases API for the current latest release
• a full semver tag like v3.13.1
• a bare semver like 3.13.1 — automatically normalized to v3.13.1

The cached sops binary is prepended to PATH and its absolute path is exported as the sops-path output.

Resolving version: latest queries the GitHub API, which is capped at 60 requests/hour per source IP when unauthenticated — easy to exhaust on shared GitHub-hosted runner IP pools. Pass the job's GITHUB_TOKEN to raise that to 1000/hour:

- name: Install SOPS
  uses: mdgreenwald/mozilla-sops-action@v2.1.1
  with:
     token: ${{ secrets.GITHUB_TOKEN }}

Native binaries are installed for all of these runners:

This action publishes immutable tags only (v2.0.0, v2.0.1, …). There is no floating v2 tag. Pin to a full semver tag — or, for the strongest guarantee, pin to the commit SHA:

- uses: mdgreenwald/mozilla-sops-action@<commit-sha> # v2.1.1

See action.yml for the canonical metadata.