bring secrets per repo

soleprint/station/tools/distill/distill-example.json

@@ -28,7 +28,7 @@
   "_with_root": "Only matters when an entry names a subpath. Keeps the repo's top-level files (README, pyproject.toml, package.json) alongside the subtree, so the copy still says which project it is a part of.",
   "with_root": false,
 
-  "_keep_secrets": ".env files, private keys, keystores and the like are dropped by default and named in MANIFEST.md. 'all' does not bring them back — only this does, and only deliberately.",
+  "_keep_secrets": ".env files, private keys, keystores and the like are dropped by default and named in MANIFEST.md. 'all' does not bring them back — only this does, and only deliberately. Set it on one entry instead to keep the secrets of that repo alone.",
   "keep_secrets": false,
 
   "_run": "skip_unchanged leaves alone anything whose source and settings have not moved since the last run into this destination. prune deletes what an earlier run into 'out' wrote and this run no longer produces, so dropping a repo from the list drops its output too. Anything distill did not write (it keeps the list in out/.distill-owned) is never touched, so 'out' can be a folder shared with other things.",

soleprint/station/tools/distill/distill.sh

@@ -68,8 +68,8 @@
 # rather than a keyed object; one entry per repo could not hold two branches of
 # the same repo. Per-entry keys: path, branches, subpath (a string, or a list
 # of them), name, enabled, branch_mode, diff_base, include, exclude, max_bytes,
-# clip_bytes, max_tokens, split_tokens, with_root — each falling back to the top
+# clip_bytes, max_tokens, split_tokens, with_root, keep_secrets — each falling
-# of the file.
+# back to the top of the file.
 # A command-line option overrides both: one repo in the list wanting a tighter
 # budget should say so in its entry, but `--max-tokens 60k` on the command line
 # is a thing someone just typed, and it wins over the whole file.
@@ -426,8 +426,6 @@ if [ -n "$CONFIG" ]; then
     [ "$(jq -r 'if has("bundle") then .bundle else false end' "$CONFIG")" = true ] && BUNDLE=1
     [ "$(jq -r 'if has("refs_patch") then .refs_patch else false end' "$CONFIG")" = true ] && REFS_PATCH=1
     [ "$(jq -r 'if has("raw_fences") then .raw_fences else false end' "$CONFIG")" = true ] && RAW_FENCES=1
-    [ "$(jq -r 'if has("keep_secrets") then .keep_secrets else false end' "$CONFIG")" = true ] \
-        && KEEP_SECRETS=1
     [ "$(jq -r 'if has("skip_unchanged") then .skip_unchanged else false end' "$CONFIG")" = true ] \
         && SKIP_UNCHANGED=1
 
@@ -471,7 +469,12 @@ if [ -n "$CONFIG" ]; then
             split_tokens: (($e.split_tokens // $cfg.split_tokens // "") | tostring),
             with_root:  (if ($e|has("with_root")) then $e.with_root
                          elif ($cfg|has("with_root")) then $cfg.with_root
-                         else false end)
+                         else false end),
+            # Per entry, like everything else: one repo whose .env is the
+            # point of the copy should not mean every repo beside it leaks.
+            keep_secrets: (if ($e|has("keep_secrets")) then $e.keep_secrets
+                           elif ($cfg|has("keep_secrets")) then $cfg.keep_secrets
+                           else false end)
           }
     ' "$CONFIG" >> "$JOBS" || die "could not read the repo list from $CONFIG"
 
@@ -1402,10 +1405,11 @@ fingerprint() {
     else
         src="plain:$(find "$dir" -type f -printf '%P %s %T@\n' 2>/dev/null | LC_ALL=C sort | cksum | cut -d" " -f1)"
     fi
-    printf '%s|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s' \
+    printf '%s|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s' \
         "$src" "$sub" "$CMD" "$BASE_REF" "$KEEP_NOISE" "$MAX_BYTES" \
         "${INCLUDES[*]-}" "${EXCLUDES[*]-}" "$MIRROR" \
         "$CLIP_BYTES" "$MAX_TOKENS" "$WITH_ROOT" "$RAW_FENCES" "${SPLIT_TOKENS:-$DEFAULT_SPLIT_TOKENS}" \
+        "$KEEP_SECRETS" \
         | cksum | cut -d' ' -f1
 }
 
@@ -1885,6 +1889,7 @@ CLI_MAX_TOKENS="$MAX_TOKENS"
 CLI_SPLIT_TOKENS="$SPLIT_TOKENS"
 CLI_KEEP_NOISE="$KEEP_NOISE"
 CLI_WITH_ROOT="$WITH_ROOT"
+CLI_KEEP_SECRETS="$KEEP_SECRETS"
 CLI_INCLUDES=(${INCLUDES[@]+"${INCLUDES[@]}"})
 CLI_EXCLUDES=(${EXCLUDES[@]+"${EXCLUDES[@]}"})
 
@@ -1906,6 +1911,8 @@ if [ -n "$CONFIG" ] && [ ${#SPECS[@]} -eq 0 ]; then
         then KEEP_NOISE=1; else KEEP_NOISE=""; fi
         if [ -n "$CLI_WITH_ROOT" ] || [ "$(job_value "$job" .with_root)" = true ]
         then WITH_ROOT=1; else WITH_ROOT=""; fi
+        if [ -n "$CLI_KEEP_SECRETS" ] || [ "$(job_value "$job" .keep_secrets)" = true ]
+        then KEEP_SECRETS=1; else KEEP_SECRETS=""; fi
 
         INCLUDES=(); EXCLUDES=()
         while IFS= read -r g; do [ -n "$g" ] && INCLUDES+=("$g"); done \