SOPS is a good way to keep secrets in git. It encrypts the values in a YAML, JSON, dotenv, INI or binary file while leaving the keys readable, so a pull request that changes a secret still shows a meaningful diff, and the file itself is safe to commit. Reviewers can see that database.password changed without ever seeing what it changed to. Here is what that looks like in practice:

database : username : app_user password : ENC[AES256_GCM,data:Hk3f...,iv:...,tag:...,type:str] sops : age : - recipient : age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p enc : | -----BEGIN AGE ENCRYPTED FILE----- ... -----END AGE ENCRYPTED FILE----- mac : ENC[AES256_GCM,data:...,iv:...,tag:...,type:str]

Enter fullscreen mode

Exit fullscreen mode

That file can live in a public repository with no loss of secrecy. The only requirement is a way to turn ENC[...] back into a usable value at runtime.

The catch is that SOPS itself is a Go command-line tool.…