sops: guard SOPS re-download / overwrite

sops/action.yml

@@ -1,5 +1,5 @@
 name: decrypt SOPS secrets
-description: installs SOPS and decrypts all *.sops.* files using an age key
+description: installs SOPS if missing and decrypts all *.sops.* files using an age key
 
 inputs:
   sops-age-key:
@@ -17,6 +17,8 @@ runs:
       run: |
         set -euo pipefail
 
+        command -v sops >/dev/null && exit 0
+
         os=$(uname -s | tr '[:upper:]' '[:lower:]')
         arch=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/')
         asset="sops-${SOPS_VERSION}.${os}.${arch}"