6 lines
539 B
Markdown
6 lines
539 B
Markdown
# secret handling with SOPS
|
|
|
|
generate new age keys with `age-keygen -o ~/.config/sops/age/key-name.txt`. encrypt local secrets with `sops -e service-name/.env > service-name/.sops.env`.
|
|
|
|
the action installs the pinned, checksum-verified SOPS build for the runner's OS/arch, caching it under `$RUNNER_TEMP/sops` keyed on the version and runner platform so later runs skip the download. it then decrypts every `*.sops.*` file except `.sops.yaml`, writing `service-name/.sops.env` back to `service-name/.env` via a temp file and atomic move.
|