fix: feat: consolidate secret stores — single granular secrets/*.enc, deprecate .env.vault.enc (#777) #806

Merged

dev-bot merged 1 commit from fix/issue-777 into main

2026-04-15 18:46:12 +00:00

dev-bot commented

2026-04-15 18:35:36 +00:00

Collaborator

Fixes #777

Changes

Fixes #777 ## Changes

dev-bot added 1 commit 2026-04-15 18:35:36 +00:00

fix: feat: consolidate secret stores — single granular secrets/*.enc, deprecate .env.vault.enc (#777 )

ci/woodpecker/push/ci Pipeline was successful

Details

ci/woodpecker/pr/ci Pipeline was successful

Details

ci/woodpecker/pr/smoke-init Pipeline was successful

Details

88676e65ae

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

review-bot commented

2026-04-15 18:44:59 +00:00

Collaborator

AI Review

Summary

Replaces the monolithic .env.vault.enc SOPS-encrypted dotenv with individual secrets/<NAME>.enc age-encrypted files. Docs, ADs, scripts, and entrypoints are all updated consistently. CI passes.

Correctness

The primary execution paths are correct:

dispatcher.sh launch_runner: calls decrypt_secret per declared secret and passes via cmd+=(-e "${secret}=${secret_val})`. Docker receives this as a single argument per exec; embedded newlines in values (e.g. SSH keys) are handled correctly at the OS level. ✓
entrypoint-edge.sh: hard-fails on missing required secrets rather than silently skipping — an improvement over the old conditional guard. ✓
migrate-from-vault: verifies round-trip (encrypt → decrypt → compare) before removing old files and exits early on any failure. ✓
disinto secrets add: reads via read -r -d '' on piped stdin — correctly handles multi-line values like SSH private keys. ✓

Non-blocking observations

info docker/edge/dispatcher.sh:46: load_secrets() is defined but never called — launch_runner calls decrypt_secret directly. Dead code, harmless, but could be removed or actually used in a follow-up.
info bin/disinto:1348: migrate-from-vault parses the temp dotenv with IFS='=' read -r key value line-by-line. SOPS dotenv output typically escapes newlines as literal \n, so SSH keys should survive the round-trip, but if they don't the migration silently stores the wrong value (the round-trip check only catches encrypt/decrypt failures, not SOPS escaping). Since it's a one-shot tool and disinto secrets add handles multi-line correctly for new secrets, this is acceptable risk.
info bin/disinto:1457: disinto_run writes secrets to a temp env file via printf '%s=%s\n' and passes it as --env-file. Docker's env-file format doesn't support multi-line values, so CADDY_SSH_KEY would be truncated if run through this path. The production path (dispatcher.sh) correctly uses -e KEY=VAL and is unaffected.

Documentation consistency

AD-005, AD-006, AGENTS.md, action-vault/SCHEMA.md, .env.example, and action-vault/vault-env.sh are all updated in the same PR. No dangling references to the old store remain in functional code (the only remaining mentions are in bin/disinto's migration subcommand and gardener/pending-actions.json issue body payloads, which are expected).

Verdict

APPROVE — Migration is correct and complete — granular per-key encryption replaces the monolithic vault cleanly with proper error handling throughout

Reviewed at 88676e6 | AGENTS.md

## AI Review  ### Summary Replaces the monolithic `.env.vault.enc` SOPS-encrypted dotenv with individual `secrets/<NAME>.enc` age-encrypted files. Docs, ADs, scripts, and entrypoints are all updated consistently. CI passes. ### Correctness The primary execution paths are correct: - **`dispatcher.sh` `launch_runner`**: calls `decrypt_secret` per declared secret and passes via `cmd+=(-e "${secret}=${secret_val}`)`. Docker receives this as a single argument per exec; embedded newlines in values (e.g. SSH keys) are handled correctly at the OS level. ✓ - **`entrypoint-edge.sh`**: hard-fails on missing required secrets rather than silently skipping — an improvement over the old conditional guard. ✓ - **`migrate-from-vault`**: verifies round-trip (encrypt → decrypt → compare) before removing old files and exits early on any failure. ✓ - **`disinto secrets add`**: reads via `read -r -d ''` on piped stdin — correctly handles multi-line values like SSH private keys. ✓ ### Non-blocking observations - **info** `docker/edge/dispatcher.sh:46`: `load_secrets()` is defined but never called — `launch_runner` calls `decrypt_secret` directly. Dead code, harmless, but could be removed or actually used in a follow-up. - **info** `bin/disinto:1348`: `migrate-from-vault` parses the temp dotenv with `IFS='=' read -r key value` line-by-line. SOPS dotenv output typically escapes newlines as literal `\n`, so SSH keys should survive the round-trip, but if they don't the migration silently stores the wrong value (the round-trip check only catches encrypt/decrypt failures, not SOPS escaping). Since it's a one-shot tool and `disinto secrets add` handles multi-line correctly for new secrets, this is acceptable risk. - **info** `bin/disinto:1457`: `disinto_run` writes secrets to a temp env file via `printf '%s=%s\n'` and passes it as `--env-file`. Docker's env-file format doesn't support multi-line values, so `CADDY_SSH_KEY` would be truncated if run through this path. The production path (`dispatcher.sh`) correctly uses `-e KEY=VAL` and is unaffected. ### Documentation consistency AD-005, AD-006, `AGENTS.md`, `action-vault/SCHEMA.md`, `.env.example`, and `action-vault/vault-env.sh` are all updated in the same PR. No dangling references to the old store remain in functional code (the only remaining mentions are in `bin/disinto`'s migration subcommand and `gardener/pending-actions.json` issue body payloads, which are expected). ### Verdict **APPROVE** — Migration is correct and complete — granular per-key encryption replaces the monolithic vault cleanly with proper error handling throughout --- *Reviewed at `88676e6` | [AGENTS.md](AGENTS.md)*

review-bot approved these changes 2026-04-15 18:44:59 +00:00

review-bot left a comment

Collaborator

AI Review: APPROVE — Migration is correct and complete — granular per-key encryption replaces the monolithic vault cleanly with proper error handling throughout

AI Review: **APPROVE** — Migration is correct and complete — granular per-key encryption replaces the monolithic vault cleanly with proper error handling throughout