Versions
The Secrets Blueprint workflows pin SOPS 3.13.3 and yq v4.47.1, check both downloads against a SHA-256 checksum before they run, and reference every GitHub Action by its full commit SHA. The repository has no OpenTofu or Terragrunt code of its own: the Cloud KMS keys and the syncer account it uses are part of the GCP Baseline and follow the Baseline's version matrix.
Where the pins live
Both workflows carry the same env block, so the pull request check and the sync decrypt with the same SOPS:
env:
SECRETS_NAMESPACE: acme # TODO: set to your namespace (projects <namespace>-plat-<stage>)
HOME_REGION: us-west1 # TODO: set to your home region (secret replication location)
SOPS_VERSION: "3.13.3"
SOPS_SHA256: e5bec3346a873ae91d871550f3e698c1aad962aff462a080e40f25fde17fef6b # sops-v3.13.3.linux.amd64, release checksums.txt
YQ_VERSION: v4.47.1
YQ_SHA256: 0fb28c6680193c41b364193d0c0fc4a03177aecde51cfc04d506b1517158c2fb # yq_linux_amd64 v4.47.1, release checksums
The install step downloads each binary from its GitHub release, runs sha256sum --check --strict against the pinned checksums and stops the job on any mismatch, before a binary ever runs. It then prints both versions into the job log.
Tools
| Tool | Version | Where it runs |
|---|---|---|
| SOPS | 3.13.3 | Both workflows, downloaded and checksum-verified in every job |
| yq (mikefarah) | v4.47.1 | Both workflows, downloaded and checksum-verified in every job |
| Google Cloud CLI | Set up by its action | Both workflows; the sync script calls gcloud secrets |
| pre-commit hooks | v6.0.0 | Local commits: check-yaml, detect-private-key, end-of-file-fixer |
Engineers who edit secrets on their own machines need sops 3.13.3, yq v4, bash 4 or later and the Google Cloud CLI, signed in with gcloud auth application-default login, because SOPS reads Application Default Credentials.
GitHub Actions
| Action | Version | Used by |
|---|---|---|
actions/checkout | v7.0.1 | Both workflows |
google-github-actions/auth | v3.0.0 | Both workflows, Workload Identity Federation |
google-github-actions/setup-gcloud | v3.0.1 | Both workflows |
actions/github-script | v9.0.0 | The plan workflow, pull request comment |
Each is referenced by its full commit SHA with the version in a comment, so a moved tag cannot change what runs.
Runners
Jobs run on GitHub-hosted ubuntu-latest runners. Setting the repository variable RUNNER_LABELS (a JSON list) moves the plan and sync jobs to the Baseline's self-hosted runners; that is needed only when VPC Service Controls are enforced. The sync workflow's detect job, which only reads Git, always runs on ubuntu-latest.
Keys
The four SOPS keys are symmetric, software-protected Cloud KMS keys that rotate automatically every 365 days. Cloud KMS encrypts with the primary key version and decrypts with whichever version encrypted, and .sops.yaml names keys without a version, so rotation needs no change to the repository and no re-encryption. See KMS key topology.
How versions change
A version change is its own pull request against the workflows, reviewed by the platform leads or infrastructure admins who own .github/. Change the version and its checksum together, in both workflows, taking the checksum from the release's checksum file; a version without its matching checksum fails the install step. The policy is on the versioning policy page.