feat: share env files as encrypted links
CI / Checks (pull_request) Failing after 10s
PR title / Conventional title (pull_request) Successful in 0s

S → f on a repo, an env file or a key in one copies a
lazysecrets://share link holding the env files, encrypted (age) with
a secret's value: whoever can read that secret can open it. The key is
share.key in the repo's .lazysecrets.yaml, else in the config, else
picked when sharing; on Azure the link pins its version. Opening one
says what it holds, decrypts when asked, and saves the files in the
clone of the repo (or a folder chosen), replacing existing ones only
when asked. lazysecrets share prints a link from the command line.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
kebandClaude Opus 5.5 committed 2026-10-13 11:59:39 +02:00
1 parent 1a5e40a012
commit 4b2f685921
26 files changed
+1541 -98

No files matched your search

+10
View File
@@ -55,6 +55,14 @@ providers:
exclude: ["**/testdata/**"]
```
A repo's `.lazysecrets.yaml` can also name the secret its env files are
[shared](links.md#sharing-env-files) with:
```yaml
share:
key: lazysecrets://azure/kv-team.vault.azure.net/secrets/env-share
```
## Decrypting
Listing never decrypts: SOPS encrypts values only, so keys and metadata
@@ -90,6 +98,8 @@ sops 3.8 or later.
## Links
`S` → `f` shares env files as an [encrypted link](links.md#sharing-env-files).
Links name the repo by its git remote, so they open in a colleague's clone
wherever it is: