Semaphore injects environment secrets as ansible extra-vars, not as process env vars, so lookup('env','OP_SERVICE_ACCOUNT_TOKEN') resolved to empty string and the op CLI hung waiting for interactive auth. Reference the variable directly instead.