jfraeys/forge-agent
Watch
1
0
Fork
You've already forked forge-agent
 0
Code Issues Pull requests 2 Projects Releases 2 Packages Wiki Activity Actions

feat(secrets): forge-agent's own SOPS keys and encrypted dev settings (P7) #6

Merged
jfraeys merged 1 commit from chore/sops-keys into main 2026-10-14 11:09:05 -04:00
Conversation 0 Commits 1 Files changed 3 +42 -2
jfraeys commented 2026-10-14 10:57:11 -04:00
Owner
Copy link

Closes the key work of P7 for forge-agent (ADR 0011).

  • .sops.yaml: the two placeholders are replaced by this project's operator key (macOS Keychain sops-age/forge-agent) and recovery key (personal Bitwarden sops-age-recovery-forge-agent, plus an offline copy). Public keys only.
  • secrets/dev.sops.yml: the four FORGE_TEST_* settings, encrypted (values are ENC[AES256_GCM,...], no plaintext).
  • docs/secrets-recovery.md: public keys, where each private half lives, the run command, how to recover on a new machine.

Verified on the operator machine 2026-10-14: sops exec-env secrets/dev.sops.yml 'go run ./dev integration' passes, and the isolation drill passed both ways (forge-agent keys decrypt only this file, never infra's secrets/vault.sops.yml; infra's keys do not decrypt this one).

Builds and tests still need none of this (go run ./dev test reads no secrets).

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ge5tovcwdEUBtPwUktsZZZ

Closes the key work of P7 for forge-agent (ADR 0011). - `.sops.yaml`: the two placeholders are replaced by this project's operator key (macOS Keychain `sops-age/forge-agent`) and recovery key (personal Bitwarden `sops-age-recovery-forge-agent`, plus an offline copy). Public keys only. - `secrets/dev.sops.yml`: the four `FORGE_TEST_*` settings, encrypted (values are `ENC[AES256_GCM,...]`, no plaintext). - `docs/secrets-recovery.md`: public keys, where each private half lives, the run command, how to recover on a new machine. Verified on the operator machine 2026-10-14: `sops exec-env secrets/dev.sops.yml 'go run ./dev integration'` passes, and the isolation drill passed both ways (forge-agent keys decrypt only this file, never infra's `secrets/vault.sops.yml`; infra's keys do not decrypt this one). Builds and tests still need none of this (`go run ./dev test` reads no secrets). 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01Ge5tovcwdEUBtPwUktsZZZ
feat(secrets): forge-agent's own SOPS keys and encrypted dev settings (P7)
All checks were successful
ci / check (pull_request) Successful in 56s
Details
04b64eece7
 
.sops.yaml now names this project's operator key (macOS Keychain) and recovery
key (personal Bitwarden plus an offline copy) in place of the placeholders.
secrets/dev.sops.yml holds the four FORGE_TEST_* settings, encrypted. Public keys
and where the private halves live are in docs/secrets-recovery.md. Verified on the
operator machine 2026-10-14: the integration run through
`sops exec-env secrets/dev.sops.yml 'go run ./dev integration'` passes, and the
recovery/operator keys decrypt only this repo's file, never infra's vault (and
infra's keys do not decrypt this one).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ge5tovcwdEUBtPwUktsZZZ
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
jfraeys/forge-agent!6
No description provided.