fix(setup): always delete plaintext vault.yml, even after staging traps

jfraeys commented

2026-10-09 20:50:23 -04:00

Owner

Plaintext secrets/vault.yml was left on disk after every staging run: setup set its cleanup as an EXIT trap, but staging.sh replaces the EXIT trap (and clear_staging_trap removes it). Found when scripts/with-vault.sh refused to run on the leftover (verified identical to the SOPS vault, then deleted).

Fix: common_vault_remove_plaintext, called from cleanup(), both staging EXIT handlers, and restored via trap cleanup EXIT in clear_staging_trap. Tested the function under a plain EXIT trap, a replaced one, and a cleared-then-restored one; it never touches vault.yml in a non-SOPS repo.

Not run end to end (a full staging run provisions VMs).

🤖 Generated with Claude Code

Plaintext secrets/vault.yml was left on disk after every staging run: setup set its cleanup as an EXIT trap, but staging.sh replaces the EXIT trap (and clear_staging_trap removes it). Found when scripts/with-vault.sh refused to run on the leftover (verified identical to the SOPS vault, then deleted). Fix: common_vault_remove_plaintext, called from cleanup(), both staging EXIT handlers, and restored via `trap cleanup EXIT` in clear_staging_trap. Tested the function under a plain EXIT trap, a replaced one, and a cleared-then-restored one; it never touches vault.yml in a non-SOPS repo. Not run end to end (a full staging run provisions VMs). 🤖 Generated with [Claude Code](https://claude.com/claude-code)

jfraeys added 1 commit

2026-10-09 20:50:23 -04:00

fix(setup): always delete the plaintext vault.yml, even after staging traps

Lint / lint (pull_request) Successful in 1m42s

Details

b260c4bbc8

setup registered the SOPS plaintext cleanup as an EXIT trap, but staging.sh
replaces the EXIT trap and clear_staging_trap removes it entirely, so every
staging run left secrets/vault.yml on disk (found as with-vault.sh's
leftover guard firing). Move the deletion into common_vault_remove_plaintext
and call it from cleanup(), both staging EXIT handlers, and by restoring
cleanup() as the EXIT trap in clear_staging_trap.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

jfraeys merged commit a5a1498c76 into main

2026-10-09 20:51:00 -04:00

jfraeys referenced this pull request from a commit

2026-10-09 20:51:02 -04:00

Merge pull request 'fix(setup): always delete plaintext vault.yml, even after staging traps' (#32) from jfraeys/fix/setup-plaintext-vault-cleanup into main

jfraeys referenced this pull request

2026-10-10 09:33:42 -04:00

fix(ci): drop the Molecule step from staging-validate #35

Rows
Columns

fix(setup): always delete plaintext vault.yml, even after staging traps #32