secrets-with-git-crypt

Secrets Management with Git-Crypt

This skill provides a secure, structured workflow for managing repository secrets (e.g. .env, *.tfvars, sec.json, settings.json) using git-crypt. It guides the agent to ensure sensitive credentials are never checked in as plaintext, instead maintaining parallel encrypted .enc versions checked into Git.

Table of Contents

• Triggers
• Prerequisites
• Secrets Setup and Sync Workflow
• Command Reference
• Verification Loop

Triggers

This skill MUST trigger whenever:

• The user mentions git-crypt, encryption, decryption, or secrets management.
• The user requests to store sensitive files (like .env, *.tfvars, settings.json, keyfiles) in the repository.
• The user attempts to commit or push files that should be encrypted (e.g. .env, *.tfvars, sec.json) to the repository.
• Cloning an existing repository that contains .enc files (e.g. .env.enc, terraform.tfvars.enc, settings.json.enc), indicating it was previously protected by git-crypt.
• Initializing a new repository and setting up local/remote secret configurations.
• Changing or adding secrets credentials that need to be committed securely.

Prerequisites

• Host Environment: Unix-like operating system (e.g., Linux, WSL, macOS).
• Git: A git repository must be initialized in the current project.
• git-crypt: The git-crypt command-line utility must be installed.
  • If missing, the helper script can attempt installation via sudo apt-get install git-crypt on Debian/Ubuntu systems.
• Helper Script: Make sure the helper script at skills/secrets-with-git-crypt/scripts/git-crypt-helper.sh is executable (chmod +x).

Secrets Setup and Sync Workflow

Copy this checklist and track your progress:

Secrets Management Progress:
- [ ] Step 1: Verify git-crypt installation
- [ ] Step 2: Initialize or unlock the repository
- [ ] Step 3: Configure tracking and gitignore rules
- [ ] Step 4: Perform file synchronization
- [ ] Step 5: Verify environment security