.sops.yaml

creation_rules:
  # `secrets?` — singular too. A `seed-repo-secret.yaml` once slipped this regex
  # and was committed in plaintext to a public remote.
  - path_regex: k8s/.*secrets?.*\.ya?ml
    age: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
feat(phase0): setup SOPS for encrypted secret management 2026-07-15 15:00:06 -07:00			`creation_rules:`
fix(ci): make the hardcoded-secret scan blocking and close the .gitignore/.sops.yaml gaps that let a plaintext deploy key through — also untracks tfplan binaries and skills-lock.json 2026-08-13 18:02:59 -07:00			# `secrets?` — singular too. A `seed-repo-secret.yaml` once slipped this regex
			`# and was committed in plaintext to a public remote.`
			`- path_regex: k8s/.secrets?.\.ya?ml`
refactor(argocd): replace SOPS CMP with ksops kustomize generator, rotate age key — CMP discover glob silently shadowed kustomize rendering of any app whose path held a .enc.yaml (MinIO Tenant/cloudflared/authentik jobs never applied); centralize 8 Secret manifests under k8s/argocd/secrets, defer 4 helm-values fragments 2026-08-12 13:16:15 -07:00			`age: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla`