feat: manifest-aware push — generator auto-add, autoAdd toggle, --frozen/--dry-run (EGB-677 stage 1)
- push syncs FROM the manifest; v1 store layout unchanged (nested entries land at <project>/<relpath>.age, same shape -w always used) - discovery (root globs + quiet package.json workspace re-scan when a manifest exists) feeds the manifest as a generator; new files auto-add with ==> notice + undo guidance - options.autoAdd committed toggle (default ON when absent); explicit false warns on undeclared files instead of enrolling them - push --frozen: declared-only for one invocation; push --dry-run: reports would-add/would-sync, touches nothing - bootstrap ordering: manifest written only after >=1 blob encrypts - declared-but-missing warns and continues; unsafe manifest path dies - jq // falsy gotcha: explicit autoAdd:false compared directly
This commit is contained in:
Brian Majewski
parent
18018dbd3b
commit
884da0965c
2 changed files with 265 additions and 3 deletions
147
secrets
147
secrets
|
|
@ -833,6 +833,27 @@ cmd_add() {
|
|||
info "Commit the manifest so other machines pick it up. To undo: edit $SECRETS_JSON_NAME and remove the entry."
|
||||
}
|
||||
|
||||
# Quietly emit "ws-dir/basename" for every env file in a package.json
|
||||
# workspace under <root>. Emits nothing (and never dies) when <root> is
|
||||
# not a workspace monorepo or jq is unavailable — plain `push` calls this
|
||||
# speculatively so a new workspace's env files keep getting discovered
|
||||
# after the one-time --workspaces generator run (EGB-677 E13).
|
||||
_maybe_workspace_env_files() {
|
||||
local root="$1"
|
||||
[ -f "$root/package.json" ] || return 0
|
||||
command -v jq >/dev/null 2>&1 || return 0
|
||||
jq -e '.workspaces' "$root/package.json" >/dev/null 2>&1 || return 0
|
||||
local ws f
|
||||
while IFS= read -r ws; do
|
||||
[ -n "$ws" ] || continue
|
||||
if collect_env_files "$root/$ws"; then
|
||||
for f in "${COLLECTED_FILES[@]}"; do
|
||||
printf '%s/%s\n' "$ws" "$(basename "$f")"
|
||||
done
|
||||
fi
|
||||
done < <(get_workspaces "$root")
|
||||
}
|
||||
|
||||
# ─── End manifest ──────────────────────────────────────────────────────
|
||||
|
||||
# Read package.json workspaces and expand globs to actual directories.
|
||||
|
|
@ -1033,7 +1054,22 @@ commit_and_push_secrets() {
|
|||
fi
|
||||
}
|
||||
|
||||
# Manifest-aware push (EGB-677 stage 1). Discovery (root globs + a quiet
|
||||
# package.json workspace re-scan when a manifest exists) feeds the
|
||||
# manifest as a GENERATOR; the sync itself runs FROM the manifest. The
|
||||
# v1 store layout is unchanged: root files land at <project>/<name>.age,
|
||||
# nested entries at <project>/<relpath>.age (same shape -w always used).
|
||||
cmd_push() {
|
||||
local frozen=false dry_run=false explicit_project=""
|
||||
while [ $# -gt 0 ]; do
|
||||
case "$1" in
|
||||
--frozen) frozen=true; shift ;;
|
||||
--dry-run) dry_run=true; shift ;;
|
||||
-*) die "Unknown push flag: $1. Usage: secrets push [--frozen] [--dry-run] [project]" ;;
|
||||
*) explicit_project="$1"; shift ;;
|
||||
esac
|
||||
done
|
||||
|
||||
check_cmd age
|
||||
check_cmd git
|
||||
resolve_store
|
||||
|
|
@ -1041,20 +1077,124 @@ cmd_push() {
|
|||
check_key
|
||||
|
||||
local project
|
||||
project=$(derive_project_name "${1:-}")
|
||||
project=$(derive_project_name "$explicit_project")
|
||||
info "Pushing secrets for project: $project"
|
||||
echo_store_if_non_default
|
||||
|
||||
local pubkey
|
||||
pubkey=$(get_pubkey)
|
||||
|
||||
# ── Manifest read (validated; absence = bootstrap) ──
|
||||
local manifest="$PWD/$SECRETS_JSON_NAME"
|
||||
local have_manifest=false auto_add=true declared=""
|
||||
if [ -e "$manifest" ]; then
|
||||
_check_manifest_file "$manifest"
|
||||
have_manifest=true
|
||||
declared=$(jq -r '.dotenv // [] | .[]' "$manifest")
|
||||
local d
|
||||
while IFS= read -r d; do
|
||||
[ -n "$d" ] || continue
|
||||
_validate_dotenv_rel_path "$d" \
|
||||
|| die "Refusing unsafe dotenv path in $SECRETS_JSON_NAME (paths must be project-relative): $d"
|
||||
done <<< "$declared"
|
||||
# NB: jq's // treats false as empty, so `.options.autoAdd // true`
|
||||
# would silently flip an explicit false back to true. Compare directly.
|
||||
auto_add=$(jq -r '.options.autoAdd | if . == false then "false" else "true" end' "$manifest")
|
||||
fi
|
||||
[ "$frozen" = true ] && auto_add=false
|
||||
|
||||
# ── Discovery: root globs + workspace re-scan (manifest projects) ──
|
||||
local discovered="" f
|
||||
if collect_env_files "$PWD"; then
|
||||
for f in "${COLLECTED_FILES[@]}"; do
|
||||
discovered="$discovered$(basename "$f")"$'\n'
|
||||
done
|
||||
fi
|
||||
if [ "$have_manifest" = true ]; then
|
||||
discovered="$discovered$(_maybe_workspace_env_files "$PWD")"$'\n'
|
||||
fi
|
||||
|
||||
# to_add = discovered − declared (deduped; pure bash 3.2, no assoc arrays)
|
||||
local to_add="" e known
|
||||
while IFS= read -r e; do
|
||||
[ -n "$e" ] || continue
|
||||
known=0
|
||||
while IFS= read -r d; do [ "$d" = "$e" ] && { known=1; break; }; done <<< "$declared"
|
||||
[ "$known" -eq 1 ] && continue
|
||||
while IFS= read -r d; do [ "$d" = "$e" ] && { known=1; break; }; done <<< "$to_add"
|
||||
[ "$known" -eq 1 ] && continue
|
||||
to_add="$to_add$e"$'\n'
|
||||
done <<< "$discovered"
|
||||
|
||||
if [ "$dry_run" = true ]; then
|
||||
info "Dry run — nothing encrypted, nothing written."
|
||||
if [ -n "$to_add" ]; then
|
||||
echo "Would add to $SECRETS_JSON_NAME:"
|
||||
while IFS= read -r e; do [ -n "$e" ] && echo " $e"; done <<< "$to_add"
|
||||
else
|
||||
echo "Nothing new to add to $SECRETS_JSON_NAME."
|
||||
fi
|
||||
if [ -n "$declared" ]; then
|
||||
echo "Would sync (declared):"
|
||||
while IFS= read -r e; do [ -n "$e" ] && echo " $e"; done <<< "$declared"
|
||||
fi
|
||||
return 0
|
||||
fi
|
||||
|
||||
# ── Build the sync list ──
|
||||
local sync_list="$declared"
|
||||
if [ "$auto_add" = true ] || [ "$have_manifest" = false ]; then
|
||||
sync_list="$declared"$'\n'"$to_add"
|
||||
else
|
||||
while IFS= read -r e; do
|
||||
[ -n "$e" ] || continue
|
||||
echo "WARNING: '$e' is not declared in $SECRETS_JSON_NAME and autoAdd is off — not synced. Run: secrets add $e" >&2
|
||||
done <<< "$to_add"
|
||||
fi
|
||||
|
||||
# ── Encrypt FROM the (effective) manifest ──
|
||||
local count=0 rel
|
||||
while IFS= read -r rel; do
|
||||
[ -n "$rel" ] || continue
|
||||
if [ ! -f "$PWD/$rel" ]; then
|
||||
echo "WARNING: '$rel' is declared in $SECRETS_JSON_NAME but not found in $PWD — skipping." >&2
|
||||
continue
|
||||
fi
|
||||
case "$rel" in
|
||||
*/*) mkdir -p "$SECRETS_DIR/$project/$(dirname "$rel")" ;;
|
||||
*) mkdir -p "$SECRETS_DIR/$project" ;;
|
||||
esac
|
||||
age -r "$pubkey" -o "$SECRETS_DIR/$project/${rel}.age" "$PWD/$rel"
|
||||
echo " $rel"
|
||||
count=$((count + 1))
|
||||
done <<< "$sync_list"
|
||||
[ "$count" -gt 0 ] && info "$project: $count file(s)"
|
||||
|
||||
local did=0
|
||||
if push_dir_to_project "$PWD" "$project" "$pubkey"; then did=1; fi
|
||||
[ "$count" -gt 0 ] && did=1
|
||||
if push_external_files "$PWD" "$project" "$pubkey"; then did=1; fi
|
||||
if [ "$did" -eq 0 ]; then
|
||||
die "No secret files (.env, .env.*, .dev.vars) or $SECRETS_FILES_NAME entries found in $PWD"
|
||||
fi
|
||||
|
||||
# ── Manifest write AFTER successful encryption (bootstrap ordering) ──
|
||||
if [ "$count" -gt 0 ] && [ -n "$to_add" ] && [ "$frozen" = false ] \
|
||||
&& { [ "$auto_add" = true ] || [ "$have_manifest" = false ]; }; then
|
||||
local add_json
|
||||
add_json=$(printf '%s' "$to_add" | jq -R -s 'split("\n") | map(select(length > 0))')
|
||||
if [ "$have_manifest" = true ]; then
|
||||
jq --argjson add "$add_json" '.dotenv = ((.dotenv // []) + $add)' "$manifest" \
|
||||
| _write_manifest_canonical "$manifest" || die "Failed to update $manifest"
|
||||
else
|
||||
jq -n --argjson add "$add_json" '{version: '"$MANIFEST_VERSION"', dotenv: $add}' \
|
||||
| _write_manifest_canonical "$manifest" || die "Failed to write $manifest"
|
||||
fi
|
||||
while IFS= read -r e; do
|
||||
[ -n "$e" ] && info "Added '$e' to $SECRETS_JSON_NAME"
|
||||
done <<< "$to_add"
|
||||
info "Commit the manifest so other machines pick it up. To undo an entry: edit $SECRETS_JSON_NAME (or use 'secrets push --frozen' to skip auto-add)."
|
||||
fi
|
||||
|
||||
commit_and_push_secrets "update $project"
|
||||
}
|
||||
|
||||
|
|
@ -1694,7 +1834,8 @@ case "${1:-help}" in
|
|||
if [ "${2:-}" = "-w" ] || [ "${2:-}" = "--workspaces" ]; then
|
||||
cmd_push_workspaces
|
||||
else
|
||||
cmd_push "${2:-}"
|
||||
shift
|
||||
cmd_push "$@"
|
||||
fi
|
||||
;;
|
||||
pull)
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue