From 93157af44ac0020b26efef3e59481513ef205d29 Mon Sep 17 00:00:00 2001 From: Jonas Kauke Date: Fri, 5 Jun 2026 11:00:54 +0200 Subject: [PATCH 1/2] fix: support unenrypted vault files for templating --- internal/installer/config_template_test.go | 6 ++---- .../installer/vault_templating_secret_store.go | 14 +++++++------- 2 files changed, 9 insertions(+), 11 deletions(-) diff --git a/internal/installer/config_template_test.go b/internal/installer/config_template_test.go index 213a0266..17d3e918 100644 --- a/internal/installer/config_template_test.go +++ b/internal/installer/config_template_test.go @@ -110,7 +110,7 @@ codesphere: Expect(string(rendered)).To(ContainSubstring(`apiToken: "super-secret-token"`)) }) - It("rejects unencrypted prod.vault.yaml files", func() { + It("supports unencrypted prod.vault.yaml files", func() { tempDir := GinkgoT().TempDir() vaultPath := filepath.Join(tempDir, "prod.vault.yaml") @@ -120,8 +120,6 @@ codesphere: _, err = installer.LoadVaultData(vaultPath, "") - Expect(err).To(HaveOccurred()) - Expect(err.Error()).To(ContainSubstring("is not SOPS-encrypted")) + Expect(err).ToNot(HaveOccurred()) }) - }) diff --git a/internal/installer/vault_templating_secret_store.go b/internal/installer/vault_templating_secret_store.go index 0179a4e5..921d3ca4 100644 --- a/internal/installer/vault_templating_secret_store.go +++ b/internal/installer/vault_templating_secret_store.go @@ -124,16 +124,16 @@ func LoadVaultData(vaultPath, ageKeyPath string) (*files.InstallVault, error) { if err != nil { return nil, fmt.Errorf("failed to inspect vault file %s: %w", vaultPath, err) } - if !encrypted { - return nil, fmt.Errorf("vault file %s is not SOPS-encrypted", vaultPath) - } - decrypted, err := DecryptFileWithSOPS(vaultPath, ageKeyPath) - if err != nil { - return nil, fmt.Errorf("failed to decrypt vault.yaml: %w", err) + if encrypted { + decrypted, err := DecryptFileWithSOPS(vaultPath, ageKeyPath) + if err != nil { + return nil, fmt.Errorf("failed to decrypt vault.yaml: %w", err) + } + data = decrypted } - vault, err := parseVaultData(decrypted) + vault, err := parseVaultData(data) if err != nil { return nil, fmt.Errorf("failed to parse decrypted vault.yaml: %w", err) } From 64f4f45a2273b16c2ee7bb06f4b985a0d89d48b4 Mon Sep 17 00:00:00 2001 From: joka134 <27293650+joka134@users.noreply.github.com> Date: Fri, 5 Jun 2026 09:03:35 +0000 Subject: [PATCH 2/2] chore(docs): Auto-update docs and licenses Signed-off-by: joka134 <27293650+joka134@users.noreply.github.com> --- NOTICE | 2 +- internal/tmpl/NOTICE | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/NOTICE b/NOTICE index df279738..9a478465 100644 --- a/NOTICE +++ b/NOTICE @@ -67,7 +67,7 @@ License URL: https://gitea.com/gitea/go-sdk/src/tag/gitea/v0.25.1/gitea/LICENSE Module: dario.cat/mergo Version: v1.0.2 License: BSD-3-Clause -License URL: Unknown +License URL: https://github.com/imdario/mergo/blob/v1.0.2/LICENSE ---------- Module: filippo.io/age diff --git a/internal/tmpl/NOTICE b/internal/tmpl/NOTICE index df279738..9a478465 100644 --- a/internal/tmpl/NOTICE +++ b/internal/tmpl/NOTICE @@ -67,7 +67,7 @@ License URL: https://gitea.com/gitea/go-sdk/src/tag/gitea/v0.25.1/gitea/LICENSE Module: dario.cat/mergo Version: v1.0.2 License: BSD-3-Clause -License URL: Unknown +License URL: https://github.com/imdario/mergo/blob/v1.0.2/LICENSE ---------- Module: filippo.io/age