fix(secrets): load_env fails closed on a decrypt error; plan-prod never prompts #93

Merged

jfraeys merged 1 commit from jfraeys/fix/load-env-fail-closed into main 2026-10-13 10:20:28 -04:00

Conversation 0 Commits 1 Files changed 2 +13 -1

jfraeys commented 2026-10-13 09:49:32 -04:00

Owner

Copy link

scripts/plan-prod.sh printed 'yaml: line 2: mapping values are not allowed' (the vault file had merge conflict markers in the shared working tree), kept going with an empty environment, and tofu then prompted for api_token with no message.

• common_vault_load_env (SOPS branch) read the vault through a process substitution, so a failing 'sops -d' was ignored and the function returned 0 with nothing exported. It now decrypts into a variable first and returns 1 with the first line of sops' error if that fails. Reproduced the exact message with a conflict-marker file: it now stops with '[ERROR] could not decrypt secrets/vault.sops.yml: yaml: line 2: …'. The real vault still loads (checked token lengths only).
• plan-prod.sh exports TF_INPUT=false so a missing variable fails with an error instead of waiting on stdin.

Other callers that use 'common_vault_load_env || …' now get the failure they were already written to handle.

🤖 Generated with Claude Code

scripts/plan-prod.sh printed 'yaml: line 2: mapping values are not allowed' (the vault file had merge conflict markers in the shared working tree), kept going with an empty environment, and tofu then prompted for api_token with no message. - common_vault_load_env (SOPS branch) read the vault through a process substitution, so a failing 'sops -d' was ignored and the function returned 0 with nothing exported. It now decrypts into a variable first and returns 1 with the first line of sops' error if that fails. Reproduced the exact message with a conflict-marker file: it now stops with '[ERROR] could not decrypt secrets/vault.sops.yml: yaml: line 2: …'. The real vault still loads (checked token lengths only). - plan-prod.sh exports TF_INPUT=false so a missing variable fails with an error instead of waiting on stdin. Other callers that use 'common_vault_load_env || …' now get the failure they were already written to handle. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

jfraeys added 1 commit 2026-10-13 10:16:26 -04:00

fix(secrets): load_env fails closed on a decrypt error; plan-prod never prompts ... 95a75dfcb3

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

jfraeys merged commit d41fc4ad18 into main 2026-10-13 10:20:28 -04:00

jfraeys referenced this pull request from a commit 2026-10-13 10:20:31 -04:00

Merge pull request 'fix(secrets): load_env fails closed on a decrypt error; plan-prod never prompts' (#93) from jfraeys/fix/load-env-fail-closed into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

jfraeys/infra!93

No description provided.