Best way automatically encrypt files with sops when git committing?

[MoltenMonster]

I've been setting up sops for secrets, I have some config files with multiple secrets in each of them inside my .config folder, that I want encrypted when I git commit (my age key is stored outside this folder). I want programs that depend on those configs to read the secrets though.

What would be the best solution? I did a bunch of looking up and didn't find specific answers, so I guess I would just make a git pre-commit hook to encrypt the files, commit, then decrypt them afterwards. Is there a command or way to encrypt decrypt all files specified in .sops.yaml?

[mg1986jp]

A git pre-commit hook is probably the most common approach. Something like:

#!/bin/sh
# .git/hooks/pre-commit
for f in $(git diff --cached --name-only --diff-filter=ACM -- '.config/*.yaml'); do
  sops -e -i "$f"
  git add "$f"
done

Then decrypt after commit:

#!/bin/sh
# .git/hooks/post-commit
for f in $(git diff --name-only HEAD~1 -- '.config/*.yaml'); do
  sops -d -i "$f"
done

The annoying part is that programs reading the config need the decrypted version. A cleaner setup might be to keep the repo files always encrypted and use a wrapper script or sops exec-file to decrypt on the fly:

sops exec-file myconfig.yaml 'myapp --config {}'

Or you could look into git-crypt which handles the encrypt-on-commit / decrypt-on-checkout transparently via git filters, though it uses GPG rather than age/AWS KMS. If you're already invested in sops+age, the pre-commit hook route is probably the way to go.

[MoltenMonster]

Now I'm using chezmoi with age, I commit encrypted files to my repo and chezmoi applies files to my home directory unencrypted (away from my repo).