env_bro 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 1f301689d1d2681e1d23b16f86096cc97c14824c932cf4612fede79b9c6b6803
+  data.tar.gz: 48cc9e85161a1b69d3d3e55a5fe4fc977a77679b22d4d0ff8445490ac5d0006a
+SHA512:
+  metadata.gz: 50852fb63ffc0305c19e15d9f9dc530f4d3e8df1ddcb00c76d821a90b5b6f872bac641bfc62a110e3c48f353302c59928cef834f6ed03d91f01fd60b35f92fd4
+  data.tar.gz: 6cfb17faf7c08792749b74cb67a5a4d8e214d9200d0f0bbfa73e81660e6407aa446fde5a498b4f438e4be7a59c622c91c820e01115fbe3773a4fb2166e3c8385

data/MIT-LICENSE

@@ -0,0 +1,20 @@
+Copyright 2026 Ruby Dev SRL (https://www.rubydev.ro)
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README.md

@@ -0,0 +1,118 @@
+# EnvBro
+
+Propose changes to Rails encrypted credentials without holding the keys.
+
+EnvBro manages the credentials of the environment it runs in: on production it edits
+`production.yml.enc`, on staging `staging.yml.enc`. Team members with permission open `/admin/env`,
+pick keys to add, change or remove, and download the re-encrypted file. They commit it on a branch and open a PR. A reviewer uploads the
+file from the PR and sees which keys changed, with values masked unless they choose to reveal them.
+
+The encryption key never leaves the server, and EnvBro never writes to the credentials file.
+
+## How it works
+
+1. **Propose:** the user sees key names only, never values. EnvBro decrypts the deployed file in memory,
+   applies the changes, re-encrypts it with the same key and sends it back as a download.
+2. **Metadata:** the new file includes an `env_bro` key holding a proposal id, the SHA-256 of the file it was built on,
+   the author, the time and the list of declared changes.
+3. **Review:** the reviewer uploads the proposed file. EnvBro decrypts it and the deployed file (or an
+   uploaded base file, such as the one on `main`), then shows added, changed and removed keys.
+   - **Outdated base:** shown when the proposal was built on a different version than the one it is
+     compared against. Encrypted files can't be merged, so a stale file would undo other people's changes.
+   - **Not built with EnvBro:** shown when the file has no metadata. It may have been edited by hand,
+     or it may be an older valid copy that someone is replaying.
+4. **Audit:** proposals, reviews and every value reveal are stored in the `env_bro_audit_events`
+   table (`EnvBro::AuditEvent`) with key names only. Rows are append-only.
+5. **Deployment tracking:** Rails reads credentials at boot, so on boot EnvBro checks whether the
+   running file came from a proposal and records a `proposal_deployed` event. The audit log then shows
+   each proposal as *live since …*, *deployed, replaced since*, *superseded* or *not deployed yet*.
+   - The match uses the SHA-256 of the file EnvBro handed out.
+   - If the file was re-encrypted after review (e.g. `rails credentials:edit` to fix a conflict),
+     EnvBro recognizes it by the proposal id in its metadata and flags it *modified after review*.
+   - The check never stops the app from booting. Without a database or table, it logs a warning and moves on.
+
+## Install
+
+```ruby
+# Gemfile
+gem "env_bro", git: "https://github.com/rubydevro/env_bro.git"
+```
+
+```sh
+bin/rails generate env_bro:install   # initializer, route, migration (--mount-path=/admin/env)
+bin/rails db:migrate
+```
+
+The generator wraps Rails' built-in `bin/rails env_bro:install:migrations`. Use that task on its own
+to pick up new migrations after upgrading the gem.
+
+Then set the permissions in `config/initializers/env_bro.rb`. Everything is denied by default:
+
+```ruby
+EnvBro.configure do |config|
+  # Who may do what. Each lambda gets the current user.
+  config.can_propose = ->(user) { user.developer? }
+  config.can_review  = ->(user) { user.admin? }
+  config.can_reveal  = ->(user) { user.admin? }
+
+  # Defaults shown:
+  # config.parent_controller = "::ApplicationController"   # gives access to your auth
+  # config.current_user = ->(controller) { controller.send(:current_user) }
+  # config.user_label = ->(user) { user.email }
+  # config.require_ssl = Rails.env.production?
+  # config.metadata_key = "env_bro"
+  # config.track_deployments = true
+end
+```
+
+## One environment per deployment
+
+EnvBro uses `Rails.application.credentials`, so it finds the file and key exactly like Rails does
+(`config/credentials/<env>.yml.enc`, `RAILS_MASTER_KEY`, `config.credentials.content_path`, ...).
+Each deployment holds only its own key, so to change staging credentials, use EnvBro on staging.
+
+If the server can't decrypt its own file (missing file, missing key or wrong key), EnvBro shows
+what's wrong instead of the forms.
+
+## Security notes
+
+- **Transport:** new values pass through the user's browser and your server. HTTPS is required in
+  production. `secret_value` and the uploaded files are added to `filter_parameters`.
+- **Caching:** all EnvBro pages are sent with `Cache-Control: no-store`.
+- **Replay:** a contributor can't forge a file without the key, but they can commit an older valid one.
+  The review diff catches this, so make review mandatory with CODEOWNERS on `config/credentials/*.yml.enc`.
+- **Reveal:** during review the encrypted files travel back with the reveal form, so the server never stores uploads.
+- **CSP:** the UI uses inline CSS and JS with your CSP nonce. There are no external assets.
+
+## Known limitations
+
+- Comments and formatting in the credentials YAML are lost when a file is rebuilt, because it is
+  re-serialized from parsed data. The values themselves are preserved.
+- New values are always stored as strings.
+
+## Development
+
+```sh
+bundle install
+bin/rails test                      # unit + integration tests
+cd test/dummy && bin/rails s        # http://localhost:3000
+```
+
+The dummy app comes with sample `development` and `test` credentials and keys in
+`test/dummy/config/credentials/`. Those keys are for testing only. Switch the fake user from the
+home page, or append `?as=viewer|developer|admin` to any URL:
+
+- `viewer`: no access
+- `developer`: can propose changes
+- `admin`: can propose, review and reveal values
+
+To try the full flow:
+
+1. As a developer, propose a change and download the file.
+2. As an admin, review that file.
+
+To check the stale-base warning, upload a different proposal as the base file.
+
+## License
+
+MIT. Built by [Ruby Dev SRL](https://www.rubydev.ro).

data/Rakefile

@@ -0,0 +1,3 @@
+require "bundler/setup"
+
+require "bundler/gem_tasks"

data/app/controllers/env_bro/application_controller.rb

@@ -0,0 +1,51 @@
+module EnvBro
+  class ApplicationController < EnvBro.config.parent_controller.constantize
+    layout "env_bro/application"
+
+    protect_from_forgery with: :exception
+
+    before_action :env_bro_require_ssl
+    before_action :env_bro_no_store
+    before_action { @environment = Environment.current }
+
+    helper_method :env_bro_user, :env_bro_can?
+
+    rescue_from EnvBro::Forbidden, with: :env_bro_forbidden
+
+    private
+      def env_bro_user
+        return @env_bro_user if defined?(@env_bro_user)
+        @env_bro_user = EnvBro.config.current_user.call(self)
+      end
+
+      # permission: :propose, :review or :reveal
+      def env_bro_can?(permission)
+        return false if env_bro_user.nil?
+        !!EnvBro.config.public_send(:"can_#{permission}").call(env_bro_user)
+      end
+
+      def env_bro_authorize!(permission)
+        raise EnvBro::Forbidden unless env_bro_can?(permission)
+      end
+
+      # The server needs this environment's key to do anything with the file.
+      def env_bro_require_ready
+        render "env_bro/shared/not_ready", status: :service_unavailable unless @environment.ready?
+      end
+
+      def env_bro_require_ssl
+        return unless EnvBro.config.require_ssl
+        head :forbidden unless request.ssl?
+      end
+
+      # Pages may show secret values: keep them out of browser and proxy caches.
+      def env_bro_no_store
+        response.headers["Cache-Control"] = "no-store"
+        response.headers["Pragma"] = "no-cache"
+      end
+
+      def env_bro_forbidden
+        render "env_bro/shared/forbidden", status: :forbidden
+      end
+  end
+end

data/app/controllers/env_bro/audit_controller.rb

@@ -0,0 +1,10 @@
+module EnvBro
+  class AuditController < ApplicationController
+    before_action { env_bro_authorize!(:review) }
+
+    def index
+      @events = AuditEvent.recent.includes(:deployment, proposal: :deployment).limit(200)
+      @live_proposal = AuditEvent.live_proposal
+    end
+  end
+end

data/app/controllers/env_bro/home_controller.rb

@@ -0,0 +1,13 @@
+module EnvBro
+  class HomeController < ApplicationController
+    def index
+      if env_bro_can?(:propose)
+        redirect_to new_proposal_path
+      elsif env_bro_can?(:review)
+        redirect_to new_review_path
+      else
+        raise EnvBro::Forbidden
+      end
+    end
+  end
+end

data/app/controllers/env_bro/proposals_controller.rb

@@ -0,0 +1,65 @@
+module EnvBro
+  class ProposalsController < ApplicationController
+    before_action { env_bro_authorize!(:propose) }
+    before_action :env_bro_require_ready
+
+    def new
+      @new_keys = [ Editor::Change.new(action: "set") ]
+      @edits = {}
+      load_outline
+    end
+
+    def create
+      @new_keys = new_key_params
+      @edits = edit_params.index_by(&:key)
+      changes = @new_keys + @edits.values.reject { |c| c.action == "set" && c.value.blank? }
+
+      result = Editor.new(@environment).apply(changes, author: EnvBro.config.user_label.call(env_bro_user))
+
+      Audit.record(:proposal_created, user: env_bro_user,
+        columns: { proposal_token: result.proposal_token, file_digest: result.file_digest },
+        changes: result.changes.map { |c| { "action" => c.action, "key" => c.key } },
+        base_digest: result.base_digest)
+
+      send_data result.cipher_text, filename: result.filename, type: "application/octet-stream", disposition: "attachment"
+    rescue *EnvBro::USER_FACING_ERRORS => e
+      @error = e.message
+      @new_keys = [ Editor::Change.new(action: "set") ] if @new_keys.blank?
+      @edits ||= {}
+      load_outline
+      render :new, status: :unprocessable_entity
+    end
+
+    private
+      # new_keys[0][key], new_keys[0][secret_value], ...
+      def new_key_params
+        indexed_rows(:new_keys).map do |row|
+          Editor::Change.new(action: "set", key: row[:key], value: row[:secret_value])
+        end
+      end
+
+      # edits[0][key], edits[0][secret_value], edits[0][remove], ... one per existing key.
+      def edit_params
+        indexed_rows(:edits).map do |row|
+          remove = row[:remove] == "1"
+          Editor::Change.new(action: remove ? "delete" : "set", key: row[:key], value: remove ? nil : row[:secret_value])
+        end
+      end
+
+      # Form rows posted with numeric indexes (which may have gaps), in order.
+      def indexed_rows(name)
+        rows = params[name]
+        return [] unless rows.respond_to?(:to_unsafe_h)
+        rows.to_unsafe_h.sort_by { |index, _| index.to_i }.map do |_, row|
+          ActionController::Parameters.new(row).permit(:key, :secret_value, :remove)
+        end
+      end
+
+      def load_outline
+        @outline = @environment.current_credentials.outline
+      rescue *EnvBro::USER_FACING_ERRORS => e
+        @outline = []
+        @error ||= e.message
+      end
+  end
+end

data/app/controllers/env_bro/reviews_controller.rb

@@ -0,0 +1,63 @@
+module EnvBro
+  class ReviewsController < ApplicationController
+    REVEAL_ALL = "*"
+
+    before_action { env_bro_authorize!(:review) }
+    before_action(only: :reveal) { env_bro_authorize!(:reveal) }
+    before_action :env_bro_require_ready
+
+    def new
+    end
+
+    def create
+      @proposed_enc = read_upload(:proposed_file) or raise EnvBro::Error, "Choose the proposed #{@environment.filename} to review."
+      @base_enc = read_upload(:base_file)
+      build_diff
+
+      Audit.record(:review_viewed, user: env_bro_user,
+        changed_keys: @differ.changes.map { |e| "#{e.status} #{e.key}" },
+        base: @base_enc ? "uploaded" : "deployed")
+
+      @revealed = []
+      render :show
+    rescue *EnvBro::USER_FACING_ERRORS => e
+      @error = e.message
+      render :new, status: :unprocessable_entity
+    end
+
+    # The encrypted files travel back with the form, so the server never stores them.
+    def reveal
+      @proposed_enc = params[:proposed_enc].to_s
+      @base_enc = params[:base_enc].presence
+      build_diff
+
+      requested = params[:reveal_key].to_s
+      @revealed = requested == REVEAL_ALL ? @differ.changes.map(&:key) : [ requested ] & @differ.entries.map(&:key)
+
+      Audit.record(:values_revealed, user: env_bro_user, keys: @revealed) if @revealed.any?
+
+      render :show
+    rescue *EnvBro::USER_FACING_ERRORS => e
+      @error = e.message
+      render :new, status: :unprocessable_entity
+    end
+
+    private
+      def build_diff
+        base_cipher_text = @base_enc || @environment.current_cipher_text
+        @base_digest = Environment.digest(base_cipher_text)
+        @differ = Differ.new(@environment.decrypt(base_cipher_text), @environment.decrypt(@proposed_enc))
+        @base_status = @differ.base_status(@base_digest)
+
+        token = @differ.proposed_metadata&.fetch("proposal_id", nil)
+        @proposal_event = AuditEvent.proposals.includes(:deployment).find_by(proposal_token: token) if token.present?
+      end
+
+      def read_upload(name)
+        file = params[name]
+        return nil if file.blank?
+        raise EnvBro::Error, "#{file.original_filename} is too large." if file.size > EnvBro.config.max_upload_bytes
+        file.read.strip
+      end
+  end
+end

data/app/helpers/env_bro/application_helper.rb

@@ -0,0 +1,59 @@
+module EnvBro
+  module ApplicationHelper
+    def env_bro_masked(value)
+      return content_tag(:span, "(none)", class: "muted") if value.nil?
+      length = env_bro_format_value(value).length
+      content_tag(:span, "•" * [ length, 12 ].min, class: "mask", title: "#{length} characters") +
+        content_tag(:span, " #{length} chars", class: "muted small")
+    end
+
+    def env_bro_value(value)
+      return content_tag(:span, "(none)", class: "muted") if value.nil?
+      content_tag(:code, env_bro_format_value(value), class: "value")
+    end
+
+    def env_bro_format_value(value)
+      value.is_a?(String) ? value : value.to_json
+    end
+
+    def env_bro_status_badge(status)
+      content_tag(:span, status.to_s, class: "badge badge-#{status}")
+    end
+
+    ENVIRONMENT_BADGES = {
+      ready: [ "ready", "ok" ],
+      missing_file: [ "file missing", "danger" ],
+      missing_key: [ "no key on server", "danger" ],
+      wrong_key: [ "key doesn't match", "danger" ]
+    }.freeze
+
+    def env_bro_environment_badge(status)
+      label, style = ENVIRONMENT_BADGES.fetch(status)
+      content_tag(:span, label, class: "badge badge-#{style}")
+    end
+
+    def env_bro_time(time)
+      time.utc.strftime("%Y-%m-%d %H:%M UTC")
+    end
+
+    # Status of a proposal_created event: live / deployed / superseded / pending.
+    def env_bro_deployment_badge(proposal, live)
+      case proposal.deployment_status(live)
+      when :live then content_tag(:span, "live since #{env_bro_time(proposal.deployment.created_at)}", class: "badge badge-ok")
+      when :deployed then content_tag(:span, "deployed #{env_bro_time(proposal.deployment.created_at)}, replaced since", class: "badge badge-neutral")
+      when :superseded then content_tag(:span, "superseded", class: "badge badge-neutral", title: "Never deployed. A newer proposal is live.")
+      else content_tag(:span, "not deployed yet", class: "badge badge-changed")
+      end
+    end
+
+    def env_bro_display_path(path)
+      path.relative_path_from(Rails.root).to_s
+    rescue ArgumentError
+      path.to_s
+    end
+
+    def env_bro_short_digest(digest)
+      digest.to_s.first(12)
+    end
+  end
+end

data/app/models/env_bro/application_record.rb

@@ -0,0 +1,5 @@
+module EnvBro
+  class ApplicationRecord < ActiveRecord::Base
+    self.abstract_class = true
+  end
+end

data/app/models/env_bro/audit_event.rb

@@ -0,0 +1,59 @@
+module EnvBro
+  # Who proposed, reviewed or revealed what, and when proposals went live.
+  # Holds key names only, never values.
+  class AuditEvent < ApplicationRecord
+    EVENTS = %w[proposal_created proposal_deployed review_viewed values_revealed].freeze
+
+    belongs_to :proposal, class_name: "EnvBro::AuditEvent", optional: true
+    has_one :deployment, -> { where(event: "proposal_deployed") }, class_name: "EnvBro::AuditEvent", foreign_key: :proposal_id
+
+    validates :event, inclusion: { in: EVENTS }
+    validates :environment, presence: true
+
+    scope :recent, -> { order(created_at: :desc, id: :desc) }
+    scope :proposals, -> { where(event: "proposal_created") }
+    scope :deployments, -> { where(event: "proposal_deployed") }
+
+    # Audit entries are append-only.
+    def readonly?
+      persisted?
+    end
+
+    # Key names touched by the event, for display.
+    def keys
+      if event == "proposal_deployed"
+        proposal&.keys || []
+      elsif details["changes"]
+        details["changes"].map { |c| "#{c['action']} #{c['key']}" }
+      else
+        Array(details["changed_keys"] || details["keys"])
+      end
+    end
+
+    # The proposal whose file is running right now, if it came from EnvBro.
+    def self.live_proposal
+      deployments.recent.first&.proposal
+    end
+
+    # For a proposal_created event:
+    #   :live       - its file is what's deployed now
+    #   :deployed   - it was deployed, a later proposal replaced it
+    #   :superseded - never deployed, and a newer proposal is live
+    #   :pending    - not deployed (yet)
+    def deployment_status(live = self.class.live_proposal)
+      if deployment
+        live&.id == id ? :live : :deployed
+      elsif live && live.created_at > created_at
+        :superseded
+      else
+        :pending
+      end
+    end
+
+    # The deployed file differs from the one EnvBro handed out (re-saved with
+    # `rails credentials:edit` after review, for instance).
+    def modified_after_review?
+      event == "proposal_deployed" && details["modified_after_review"] == true
+    end
+  end
+end

data/app/views/env_bro/audit/index.html.erb

@@ -0,0 +1,36 @@
+<% content_for :title, "Audit log" %>
+<div class="page-head">
+  <div>
+    <h1>Audit log</h1>
+    <p class="muted">Who proposed, reviewed or revealed what, and when proposals went live. Key names only, never values.</p>
+  </div>
+</div>
+
+<div class="panel">
+  <% if @events.empty? %>
+    <p class="empty">Nothing recorded yet.</p>
+  <% else %>
+    <table>
+      <thead>
+        <tr><th>When</th><th>Who</th><th>Event</th><th>Keys</th><th>Status</th></tr>
+      </thead>
+      <tbody>
+        <% @events.each do |event| %>
+          <tr>
+            <td class="nowrap small" title="<%= event.created_at.utc.iso8601 %>"><%= env_bro_time(event.created_at) %></td>
+            <td><%= event.user_label %></td>
+            <td class="nowrap"><span class="badge badge-neutral"><%= event.event.humanize %></span></td>
+            <td class="key"><%= safe_join(event.keys, tag.br) %></td>
+            <td class="nowrap small">
+              <% if event.event == "proposal_created" %>
+                <%= env_bro_deployment_badge(event, @live_proposal) %>
+              <% elsif event.modified_after_review? %>
+                <span class="badge badge-changed" title="The deployed file is not the one EnvBro built. It was re-encrypted after review.">modified after review</span>
+              <% end %>
+            </td>
+          </tr>
+        <% end %>
+      </tbody>
+    </table>
+  <% end %>
+</div>

data/app/views/env_bro/proposals/_new_key_row.html.erb

@@ -0,0 +1,7 @@
+<div class="newkey-row" data-new-key-row>
+  <input type="text" name="new_keys[<%= index %>][key]" value="<%= change.key %>" placeholder="stripe.publishable_key"
+    autocomplete="off" spellcheck="false" aria-label="New key" class="mono" data-track>
+  <textarea name="new_keys[<%= index %>][secret_value]" rows="1" placeholder="Value"
+    autocomplete="off" spellcheck="false" aria-label="Value" data-track data-autogrow><%= change.value %></textarea>
+  <button type="button" class="icon-btn" data-remove-new-key title="Remove" aria-label="Remove this new key">✕</button>
+</div>

data/app/views/env_bro/proposals/new.html.erb

@@ -0,0 +1,82 @@
+<% content_for :title, "Propose · #{@environment.name}" %>
+<div class="page-head">
+  <div>
+    <h1>Propose a change to <%= @environment.name %></h1>
+    <p class="muted">Existing values stay hidden. Type a value to replace one, tick <em>remove</em> to drop a key, or add new keys.</p>
+  </div>
+</div>
+
+<% if @error %>
+  <div class="alert alert-error"><%= @error %></div>
+<% end %>
+
+<%= form_with url: proposal_path, method: :post, local: true, data: { proposal_form: true, turbo: false } do %>
+  <section class="panel">
+    <div class="toolbar">
+      <h2>Add new keys</h2>
+      <button type="button" class="btn btn-small" data-add-new-key>+ Another key</button>
+    </div>
+    <div data-new-keys>
+      <% @new_keys.each_with_index do |change, i| %>
+        <%= render "new_key_row", change: change, index: i %>
+      <% end %>
+    </div>
+    <p class="hint">Nest keys with dots: <code>stripe.publishable_key</code> goes under <code>stripe:</code>. A new group is created if needed.</p>
+  </section>
+
+  <section class="panel panel-flush">
+    <div class="toolbar panel-pad">
+      <h2><code><%= @environment.filename %></code></h2>
+      <input type="search" class="filter" placeholder="Filter keys…" data-filter aria-label="Filter keys">
+    </div>
+
+    <% if @outline.empty? %>
+      <p class="empty">This file has no keys yet. Add some above.</p>
+    <% else %>
+      <div class="yaml">
+        <% index = 0 %>
+        <% @outline.each do |line| %>
+          <% if line.group %>
+            <div class="yaml-line yaml-group" data-group="<%= line.path %>">
+              <span class="yaml-key depth-<%= [ line.depth, 6 ].min %>"><%= line.name %>:</span>
+            </div>
+          <% else %>
+            <% edit = @edits[line.path] %>
+            <% removed = edit&.action == "delete" %>
+            <div class="yaml-line yaml-leaf<%= ' is-removed' if removed %><%= ' is-changed' if edit&.value.present? %>" data-leaf="<%= line.path %>">
+              <label class="yaml-key depth-<%= [ line.depth, 6 ].min %>" for="edit_<%= index %>"><%= line.name %>:</label>
+              <input type="hidden" name="edits[<%= index %>][key]" value="<%= line.path %>">
+              <textarea name="edits[<%= index %>][secret_value]" id="edit_<%= index %>" rows="1" placeholder="•••••• unchanged"
+                autocomplete="off" spellcheck="false" data-track data-autogrow<%= ' disabled' if removed %>><%= edit&.value unless removed %></textarea>
+              <label class="remove-toggle" title="Remove <%= line.path %>">
+                <input type="checkbox" name="edits[<%= index %>][remove]" value="1" data-track data-remove-toggle<%= ' checked' if removed %>> remove
+              </label>
+            </div>
+            <% index += 1 %>
+          <% end %>
+        <% end %>
+        <p class="empty hidden" data-filter-empty>No keys match.</p>
+      </div>
+    <% end %>
+  </section>
+
+  <div class="submitbar">
+    <span class="muted" data-summary>No changes yet</span>
+    <button type="submit" class="btn btn-primary" data-submit>Build &amp; download <%= @environment.filename %></button>
+  </div>
+
+  <div id="download-notice" class="alert alert-ok" hidden>
+    <strong>Your download should start now.</strong> Next:
+    <ol class="steps mt-12">
+      <li>Create a branch in the app repo.</li>
+      <li>Replace <code><%= env_bro_display_path(@environment.content_path) %></code> with the downloaded file.</li>
+      <li>Commit, push and open a pull request. Mention which keys you changed and why.</li>
+      <li>A reviewer checks it in EnvBro and merges.</li>
+    </ol>
+    <p class="small mt-12">If someone else's change merges first, build your file again. Encrypted files can't be merged.</p>
+  </div>
+<% end %>
+
+<template id="new-key-template">
+  <%= render "new_key_row", change: EnvBro::Editor::Change.new(action: "set"), index: "__INDEX__" %>
+</template>

data/app/views/env_bro/reviews/new.html.erb

@@ -0,0 +1,32 @@
+<% content_for :title, "Review · #{@environment.name}" %>
+<div class="page-head">
+  <div>
+    <h1>Review a proposed <%= @environment.name %> file</h1>
+    <p class="muted">Upload the <code><%= @environment.filename %></code> from the pull request to see which keys it changes.</p>
+  </div>
+</div>
+
+<% if @error %>
+  <div class="alert alert-error"><%= @error %></div>
+<% end %>
+
+<%= form_with url: review_path, method: :post, multipart: true, local: true, data: { turbo: false } do %>
+  <div class="panel">
+    <div class="field">
+      <label for="proposed_file">Proposed file</label>
+      <input type="file" name="proposed_file" id="proposed_file" accept=".enc" required>
+      <p class="hint">Download it from the PR branch, e.g. <code>git show my-branch:<%= env_bro_display_path(@environment.content_path) %> &gt; <%= @environment.filename %></code>.</p>
+    </div>
+
+    <details class="field">
+      <summary>Compare against another version (optional)</summary>
+      <div class="mt-12">
+        <label for="base_file">Base file</label>
+        <input type="file" name="base_file" id="base_file" accept=".enc">
+        <p class="hint">By default the proposal is compared with the file deployed on this server. Upload the file from <code>main</code> if it is ahead of what's deployed.</p>
+      </div>
+    </details>
+
+    <button type="submit" class="btn btn-primary">Show changes</button>
+  </div>
+<% end %>