Add git-conceal-unlock wrapper
#195
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
AliSoftware
force-pushed
the
git-crypt-unlock
branch
from
2d3483a to
e79b4e5
Compare
wzieba
reviewed
Nov 17, 2025
Contributor
Author
|
I believe the test failure on CI is unrelated to this PR and might instead be related to our recent changes to those scripts, or how the test tries to source those scripts for testing (especially as @mokagio Care to take a look to fix that unrelated part (in a separate PR)? |
Merged
AliSoftware
force-pushed
the
git-crypt-unlock
branch
2 times, most recently
from
4b2999c to
13e3bb6
Compare
That auto-downloads the binary from GitHub Release (using the `install.sh` script of the `git-conceal` repo) if it doesn't exist locally, before running `git-conceal unlock` on the current repo to decrypt the secrets
AliSoftware
force-pushed
the
git-crypt-unlock
branch
from
0eddea7 to
9ab2426
Compare
mokagio
reviewed
Dec 4, 2025
Co-authored-by: Gio Lodi <[email protected]>
Co-authored-by: Gio Lodi <[email protected]>
Co-authored-by: Gio Lodi <[email protected]>
To indicate its name having the `_SECRET_KEY` suffix was chosen purposely so its value would be redacted in the Buildkite logs if it were accidentally leaked.
mokagio
approved these changes
Dec 5, 2025
Contributor
mokagio
left a comment
mokagio
left a comment
There was a problem hiding this comment.
I pointed the guinea pig PR to the latest commit on this branch to confirm the latest worked as expected. All green other than the Dangermattic check, which is unrelated
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Closes AINFRA-1606
What?
This PR adds
bin/git-conceal-unlockhelper which takes care of downloadinggit-conceal(using theinstall.shscript from Automattic/git-conceal#3) if it's not installed on the CI machine first, then executinggit-conceal unlock env:${1:-GIT_CONCEAL_SECRET_KEY}to unlock the repo.Testing
This has been tested as part of woocommerce/woocommerce-android#14979
Changelog
CHANGELOG.mdif necessary.