---
name: "sops-age-encrypted-git-secrets"
description: "Encrypt sensitive YAML, JSON, and ENV files safely in Git repositories with SOPS and Age."
metadata:
  author: "Getsops"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "encrypt file with sops and age"
  - "decrypt sops yaml file"
  - "configure .sops.yaml"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# SOPS & Age Encrypted Git-Committed Secrets

Manages GitOps secrets using Mozilla SOPS and Age keys: encrypting only YAML values while leaving keys readable for git diffing, KMS integration, and ArgoCD decrypt plugins.

## When to Invoke
Invoke this skill whenever you need to:
- encrypt file with sops and age
- decrypt sops yaml file
- configure .sops.yaml

## Execution SOP & Rules
1. Generate Age key pairs with age-keygen -o key.txt and extract public key.
2. Define recipient keys and path patterns in root .sops.yaml configuration file.
3. Encrypt files with sops -e -i secrets.enc.yaml; SOPS preserves readable top-level YAML keys.
4. Export SOPS_AGE_KEY in runtime environments to allow automated in-memory decryption.

## Verification Checklist
- Run local linting, syntax validation, and type-checks before reporting completion.
- Ensure all created or modified files adhere to workspace boundaries and avoid uncommitted secrets.
- Verify tests or build commands exit cleanly with return code 0.