mirror of
https://github.com/vhaudiquet/homeprod.git
synced 2026-09-21 16:36:05 +00:00
kosmosandvhaudiquet
1623b2ea7d
The prior postUpgradeTasks command 'sops -d ... && sops -e' was wrong: Renovate has no preUpgradeTasks hook, and postUpgradeTasks runs AFTER Renovate rewrites the file. These values.yaml are SOPS documents whose sops.mac authenticates the whole file, so editing a plaintext image.tag invalidates the MAC and 'sops -d' then fails (data-integrity error). The claimed decrypt-after-bump therefore could never work. boot.sh now decrypts every values.yaml in the checkout BEFORE Renovate extracts/edits them, committing the decrypted tree locally (never pushed, so no plaintext secrets enter remote git). postUpgradeTasks is reduced to 'sops -e -i' only (the file is already plaintext when Renovate edits it). Validated: kustomize build passes for the whole kubernetes/ tree.