env-sync

Environment Sync & Configuration Management

Action: $ARGUMENTS (default: check)

Parse $ARGUMENTS:

• check — Audit all .env files for parity and missing variables
• diff <env1> <env2> — Compare two environment files side by side
• encrypt — Encrypt sensitive .env values using age/sops
• rotate — Guide through secret rotation for all services
• init — Generate .env.example and environment templates
• No argument = check

---

Step 0: Discover Environment Files

echo "=== Environment Files ==="
find . -maxdepth 3 -name ".env*" -not -path "*/node_modules/*" -not -path "*/.git/*" -not -path "*/.venv/*" 2>/dev/null | sort

echo ""
echo "=== Git-tracked .env Files (DANGER) ==="
git ls-files | grep -i '\.env' 2>/dev/null || echo "None (good)"

echo ""
echo "=== .gitignore Coverage ==="
grep -n "env" .gitignore 2>/dev/null || echo "WARNING: No .env entries in .gitignore"

echo ""
echo "=== Docker Compose env_file References ==="
grep -rn "env_file" docker-compose*.yml docker/docker-compose*.yml 2>/dev/null | head -10

echo ""
echo "=== Kubernetes Secrets/ConfigMaps ==="
find . -maxdepth 4 -name "*.yaml" -o -name "*.yml" 2>/dev/null | xargs grep -l "kind: Secret\|kind: ConfigMap" 2>/dev/null | head -10

Build a map of all environment files and their purposes:

• .env → Local development
• .env.development → Development overrides
• .env.staging → Staging environment
• .env.production → Production environment
• .env.test → Test environment
• .env.example → Template (should be committed)

---

Step 1: Parse All Environment Files

For each .env* file found, parse into a structured map:

{
  "file": ".env",
  "variables": {
    "DATABASE_URL": { "value": "mysql://...", "has_value": true, "is_secret": true },
    "DEBUG": { "value": "true", "has_value": true, "is_secret": false },
    ...
  }
}

Secret detection heuristics — mark as is_secret: true if the variable name contains:

• PASSWORD, PASSWD, PWD
• SECRET, KEY (but not PUBLIC_KEY)
• TOKEN (but not TOKEN_EXPIRY)
• API_KEY, APIKEY
• PRIVATE
• CREDENTIALS, CRED
• CONNECTION_STRING, DATABASE_URL, MONGO_URI, REDIS_URL