install-cli-action

GitHub Action that downloads and installs the Proton Pass CLI into the workflow PATH.

Usage

Install the latest version

- name: Install Proton Pass CLI
  uses: protonpass/install-cli-action@v1

Install a specific version

- name: Install Proton Pass CLI
  uses: protonpass/install-cli-action@v1
  with:
    version: '2.1.4'

Pin to a specific version and provide the hash yourself

- name: Install Proton Pass CLI
  uses: protonpass/install-cli-action@v1
  with:
    version: '2.1.4'
    hash: '60d54456726378d80917de0e05d2e102697ee043b7e420a34d55c8437ced89f2'

Target a specific platform

- name: Install Proton Pass CLI
  uses: protonpass/install-cli-action@v1
  with:
    platform: 'linux-aarch64'

Install and authenticate in one step

If PROTON_PASS_PERSONAL_ACCESS_TOKEN is set, the action also logs in after installing the binary. This is useful when subsequent steps call pass-cli directly rather than going through pass-cli-load-secret-action.

- name: Install Proton Pass CLI
  uses: protonpass/install-cli-action@v1
  env:
    PROTON_PASS_PERSONAL_ACCESS_TOKEN: ${{ secrets.PROTON_PAT }}

If PROTON_PASS_PERSONAL_ACCESS_TOKEN is not set the login step is skipped and the action only installs the binary. If a valid session is already present (e.g. from a prior step in the same job), login is also skipped.

Inputs

Input	Required	Default	Description
version	No	latest	Version of pass-cli to install. When latest the action resolves the newest release from the GitHub API.
hash	No		Expected SHA256 hash of the downloaded binary. When omitted the hash is fetched from the official .sha256 release file. Hash verification always runs regardless of how the hash is provided.
platform	No	auto-detect	Target platform. Auto-detected from the runner when omitted. Accepted values: linux-aarch64, linux-x86_64, macos-aarch64, macos-x86_64, windows-x86_64.

Environment variables

Variable	Required	Description
PROTON_PASS_PERSONAL_ACCESS_TOKEN	No	When set, the action logs in to Proton Pass after installing the binary. Masked in all logs.

Supported platforms

Platform	Runner
linux-x86_64	ubuntu-*
linux-aarch64	ubuntu-* (arm)
macos-x86_64	macos-13 and earlier
macos-aarch64	macos-14 and later
windows-x86_64	windows-*

Security

SHA256 hash verification is always performed, whether the hash is supplied as an input or fetched from the official release. The action fails immediately if the downloaded binary does not match the expected hash.