From 2ef6139957681aff44b2e2fcda881408b6f78a2b Mon Sep 17 00:00:00 2001 From: buenosaires Date: Tue, 22 Sep 2026 14:00:06 -0300 Subject: [PATCH] bring secrets per repo --- .../tools/distill/distill-example.json | 2 +- soleprint/station/tools/distill/distill.sh | 19 +++++++++++++------ 2 files changed, 14 insertions(+), 7 deletions(-) diff --git a/soleprint/station/tools/distill/distill-example.json b/soleprint/station/tools/distill/distill-example.json index f931036..465a1c6 100644 --- a/soleprint/station/tools/distill/distill-example.json +++ b/soleprint/station/tools/distill/distill-example.json @@ -28,7 +28,7 @@ "_with_root": "Only matters when an entry names a subpath. Keeps the repo's top-level files (README, pyproject.toml, package.json) alongside the subtree, so the copy still says which project it is a part of.", "with_root": false, - "_keep_secrets": ".env files, private keys, keystores and the like are dropped by default and named in MANIFEST.md. 'all' does not bring them back — only this does, and only deliberately.", + "_keep_secrets": ".env files, private keys, keystores and the like are dropped by default and named in MANIFEST.md. 'all' does not bring them back — only this does, and only deliberately. Set it on one entry instead to keep the secrets of that repo alone.", "keep_secrets": false, "_run": "skip_unchanged leaves alone anything whose source and settings have not moved since the last run into this destination. prune deletes what an earlier run into 'out' wrote and this run no longer produces, so dropping a repo from the list drops its output too. Anything distill did not write (it keeps the list in out/.distill-owned) is never touched, so 'out' can be a folder shared with other things.", diff --git a/soleprint/station/tools/distill/distill.sh b/soleprint/station/tools/distill/distill.sh index d41d627..35c411f 100755 --- a/soleprint/station/tools/distill/distill.sh +++ b/soleprint/station/tools/distill/distill.sh @@ -68,8 +68,8 @@ # rather than a keyed object; one entry per repo could not hold two branches of # the same repo. Per-entry keys: path, branches, subpath (a string, or a list # of them), name, enabled, branch_mode, diff_base, include, exclude, max_bytes, -# clip_bytes, max_tokens, split_tokens, with_root — each falling back to the top -# of the file. +# clip_bytes, max_tokens, split_tokens, with_root, keep_secrets — each falling +# back to the top of the file. # A command-line option overrides both: one repo in the list wanting a tighter # budget should say so in its entry, but `--max-tokens 60k` on the command line # is a thing someone just typed, and it wins over the whole file. @@ -426,8 +426,6 @@ if [ -n "$CONFIG" ]; then [ "$(jq -r 'if has("bundle") then .bundle else false end' "$CONFIG")" = true ] && BUNDLE=1 [ "$(jq -r 'if has("refs_patch") then .refs_patch else false end' "$CONFIG")" = true ] && REFS_PATCH=1 [ "$(jq -r 'if has("raw_fences") then .raw_fences else false end' "$CONFIG")" = true ] && RAW_FENCES=1 - [ "$(jq -r 'if has("keep_secrets") then .keep_secrets else false end' "$CONFIG")" = true ] \ - && KEEP_SECRETS=1 [ "$(jq -r 'if has("skip_unchanged") then .skip_unchanged else false end' "$CONFIG")" = true ] \ && SKIP_UNCHANGED=1 @@ -471,7 +469,12 @@ if [ -n "$CONFIG" ]; then split_tokens: (($e.split_tokens // $cfg.split_tokens // "") | tostring), with_root: (if ($e|has("with_root")) then $e.with_root elif ($cfg|has("with_root")) then $cfg.with_root - else false end) + else false end), + # Per entry, like everything else: one repo whose .env is the + # point of the copy should not mean every repo beside it leaks. + keep_secrets: (if ($e|has("keep_secrets")) then $e.keep_secrets + elif ($cfg|has("keep_secrets")) then $cfg.keep_secrets + else false end) } ' "$CONFIG" >> "$JOBS" || die "could not read the repo list from $CONFIG" @@ -1402,10 +1405,11 @@ fingerprint() { else src="plain:$(find "$dir" -type f -printf '%P %s %T@\n' 2>/dev/null | LC_ALL=C sort | cksum | cut -d" " -f1)" fi - printf '%s|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s' \ + printf '%s|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s' \ "$src" "$sub" "$CMD" "$BASE_REF" "$KEEP_NOISE" "$MAX_BYTES" \ "${INCLUDES[*]-}" "${EXCLUDES[*]-}" "$MIRROR" \ "$CLIP_BYTES" "$MAX_TOKENS" "$WITH_ROOT" "$RAW_FENCES" "${SPLIT_TOKENS:-$DEFAULT_SPLIT_TOKENS}" \ + "$KEEP_SECRETS" \ | cksum | cut -d' ' -f1 } @@ -1885,6 +1889,7 @@ CLI_MAX_TOKENS="$MAX_TOKENS" CLI_SPLIT_TOKENS="$SPLIT_TOKENS" CLI_KEEP_NOISE="$KEEP_NOISE" CLI_WITH_ROOT="$WITH_ROOT" +CLI_KEEP_SECRETS="$KEEP_SECRETS" CLI_INCLUDES=(${INCLUDES[@]+"${INCLUDES[@]}"}) CLI_EXCLUDES=(${EXCLUDES[@]+"${EXCLUDES[@]}"}) @@ -1906,6 +1911,8 @@ if [ -n "$CONFIG" ] && [ ${#SPECS[@]} -eq 0 ]; then then KEEP_NOISE=1; else KEEP_NOISE=""; fi if [ -n "$CLI_WITH_ROOT" ] || [ "$(job_value "$job" .with_root)" = true ] then WITH_ROOT=1; else WITH_ROOT=""; fi + if [ -n "$CLI_KEEP_SECRETS" ] || [ "$(job_value "$job" .keep_secrets)" = true ] + then KEEP_SECRETS=1; else KEEP_SECRETS=""; fi INCLUDES=(); EXCLUDES=() while IFS= read -r g; do [ -n "$g" ] && INCLUDES+=("$g"); done \