feat(secrets): S2 — SOPS+age provider (offline default) - #31
Merged
Conversation
The "works on a plane" provider: a secrets.Provider that decrypts via the `sops` binary (NOT the getsops Go SDK, which pulls every cloud-KMS SDK and bloats the static binary — DECISIONS). - SopsProvider.Resolve groups refs by file and runs `sops -d --output-type json <file>` ONCE per file (batch), then extracts each ref's dot-path key from the decrypted JSON. SOPS_AGE_KEY_FILE is set from the provider config so the age identity is found regardless of platform default key paths. - SopsFactory + RegisterBuiltins(reg) wire it under kind "sops"; AWS/Infisical register additively (S3/S4). Missing binary / missing key are clear errors. - lookupPath walks nested maps and stringifies scalar leaves. Unit-tested with a fake runner: batch-per-file (2 refs → 1 decrypt), missing-key error, sops-absent error, factory wiring (ageKeyFile), lookupPath nested/scalar/ missing. The real `sops` path is standard `-d --output-type json`; a sops-in-CI integration + the S6 no-leak test exercise it end to end once sops is on the runner. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Chunk S2 (M4)
The offline, no-account "works on a plane" provider — a
secrets.Providerdecrypting via thesopsbinary (not the getsops Go SDK, which pulls every cloud-KMS SDK and bloats the static binary).SopsProvider.Resolvegroups refs by file and runssops -d --output-type json <file>once per file (batch), then extracts each ref's dot-path key from the JSON.SOPS_AGE_KEY_FILEis set from the provider config.SopsFactory+RegisterBuiltins(reg)wire it under kindsops(AWS/Infisical register additively, S3/S4). Missing binary / missing key → clear errors.lookupPathwalks nested maps, stringifies scalar leaves.Tests
Fake runner: batch-per-file (2 refs → 1 decrypt), missing-key error, sops-absent error, factory wiring,
lookupPathnested/scalar/missing. (sops isn't on the local/CI runner yet; the standard-d --output-type jsonpath + S6's no-leak test exercise it end-to-end once sops is installed.)Gate
make cigreen (race).🤖 Generated with Claude Code