deemanone/beanflows
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(secrets): add secrets-updatekeys-prod target, use --input-type dotenv

Browse Source 
sops updatekeys doesn't inherit --input-type from context, so calling it bare
on .env.prod.sops causes "Error unmarshalling input json" (guesses JSON from
the .sops extension). Explicit --input-type dotenv fixes it.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Deeman
2026-02-27 07:40:03 +01:00
parent 7d3263a39c
commit 54dbb296dd
2 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
Makefile
View File

@@ -5,7 +5,8 @@ SOPS_DOTENV := sops --input-type dotenv --output-type dotenv
.PHONY: help dev css-build css-watch \
secrets-decrypt-dev secrets-decrypt-prod \
secrets-edit-dev secrets-edit-prod \
secrets-encrypt-dev secrets-encrypt-prod
secrets-encrypt-dev secrets-encrypt-prod \
secrets-updatekeys-prod
help:
@echo "Available targets:"
@@ -18,6 +19,7 @@ help:
@echo " secrets-edit-prod Edit .env.prod.sops in \$$EDITOR"
@echo " secrets-encrypt-dev Encrypt .env (plaintext) → .env.dev.sops"
@echo " secrets-encrypt-prod Encrypt .env (plaintext) → .env.prod.sops"
@echo " secrets-updatekeys-prod Re-encrypt .env.prod.sops for all keys in .sops.yaml"
# ── Dev environment ───────────────────────────────────────────────────────────
@@ -65,3 +67,6 @@ secrets-encrypt-dev:
secrets-encrypt-prod:
$(SOPS_DOTENV) --encrypt --in-place .env.prod.sops
@echo "Encrypted .env.prod.sops (commit this file)"
secrets-updatekeys-prod:
sops updatekeys --input-type dotenv .env.prod.sops