fix(secrets): drop forced dotenv types on sops decrypt in env.py (KI-98)

fix(secrets): drop forced dotenv types on sops decrypt in env.py #98

Merged

Follow-up to PR #97. sops stores the original format in its envelope metadata and auto-detects it on decrypt — forcing --input-type/--output-type dotenv makes sops re-parse its own JSON envelope as dotenv and fail with 'invalid dotenv input line: {'. This broke runtime secret loading for any .env.sops encrypted with the default JSON envelope (found while bootstrapping staging).

Verified: staging runtime secret decryption now works end-to-end (migrations ran past env loading).

Copy

Commits were merged into target branch

fix(secrets): drop forced dotenv types on sops decrypt in env.py

sops stores the original format in its envelope metadata and
auto-detects it on decrypt. Forcing --input-type/--output-type dotenv
makes sops re-parse its own JSON envelope as dotenv and fail with
'invalid dotenv input line: {' — breaking runtime secret loading for
any .env.sops encrypted with the default (JSON) envelope.

Co-authored-by: Syntropic Agent <syntropic-agent@kokonut.network>

3 weeks ago

1e5cd177

fix(ci): drop git usage from deploy-staging job container

The job container (ubuntu:24.04 + curl only) has no git; the SHA echo
used git rev-parse and failed with 127. The helper container does the
fetch/reset itself, so the line was redundant.

Co-authored-by: Syntropic Agent <syntropic-agent@kokonut.network>

3 weeks ago

2520aa19

syntropicagent merged 3 weeks ago (merge commit: 7495d57e )
Login to comment

Submitter	syntropicagent
Target	main
Source	fix/sops-staging-key

Jobs

Merge Strategy

Create Merge Commit

Watchers (1)

Reference

pr KI-98