SKILL.md
Using sops
Repositories that use this layout commit their secrets to git as sops-encrypted
dotenv files, one per deployment environment: secrets/dev.env, secrets/prod.env. The
files decrypt with age identities. There is no .env, no secrets service, and no session
to log in to. Every checkout, worktree, and cloud sandbox has the encrypted files at
clone; the only input anywhere is an age private key.
pnpm secrets (tools/secrets.ts) is the only interface. Do not call sops directly in a
repo that has the wrapper.
Identities
| Identity | Scope | Where the private key lives | Decrypts |
|---|---|---|---|
agent |
user-wide | sops's user key file on every machine agents run on (references/setup.md step 3 has its path); SOPS_AGE_KEY in cloud sandboxes |
dev.env |
personal |
user-wide | the user's password manager | files listing its public key |
prod |
per project | that project's production platform and documented password-manager item | prod.env |