@brutalsystems/dray 0.1.3 → 0.1.4

package/README.md

@@ -57,7 +57,9 @@ Global flags: `--dry-run` (print the plan, run nothing), `--allow-dirty`
       "dockerfile": "Dockerfile", "context": ".",
       // optional: rebuild a cached deps layer when lockfiles change
       "depsImage": { "dockerfile": "Dockerfile.deps", "tag": "app:deps", "rebuildOn": ["uv.lock"] },
-      // optional: inject --build-arg from an env file (e.g. VITE_* from .env.production)
+      // optional: inject --build-arg from an env file (e.g. VITE_* from .env.production),
+      // or from a sops-encrypted file decrypted in memory at build time (no plaintext on disk):
+      //   "buildArgs": { "sopsEnvFile": "secrets.env", "prefix": "VITE_" }
       "buildArgs": { "envFile": ".env.production", "prefix": "VITE_" } },
     // image from another repo (cloned to a tmp dir, built, pushed):
     { "name": "svc", "ecr": "svc", "source": { "git": "https://github.com/org/svc", "ref": "main" } }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brutalsystems/dray",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "Convention-driven multi-repo deploy orchestrator (forge for shipping)",
   "bin": {
     "dray": "bin/dray.js"

package/src/core/buildArgs.js

@@ -1,4 +1,5 @@
 const fs = require('node:fs'); const path = require('node:path');
+let _run = require('../primitives/exec').run; function _withRun(fn) { _run = fn; }
 
 function stripQuotes(v) {
   const t = v.trim();
@@ -8,27 +9,38 @@ function stripQuotes(v) {
   return t;
 }
 
+// Parse dotenv-style text into ["KEY=VALUE", ...], filtered by `prefix`.
+function parseEnvLines(text, prefix) {
+  const out = [];
+  for (const line of text.split('\n')) {
+    const m = line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/);
+    if (!m) continue;
+    const [, k, v] = m;
+    if (prefix && !k.startsWith(prefix)) continue;
+    out.push(`${k}=${stripQuotes(v)}`);
+  }
+  return out;
+}
+
 // Returns ["KEY=VALUE", ...] for `docker build --build-arg`. An image may set
-// `buildArgs: { envFile, prefix }` to inject vars from an env file (e.g. VITE_*
-// from .env.production), and/or `buildArgs.values: { K: V }` for explicit pairs.
-function resolveBuildArgs(image, cwd) {
+// `buildArgs: { envFile, prefix }` to inject vars from a plaintext env file
+// (e.g. VITE_* from .env.production), `buildArgs: { sopsEnvFile, prefix }` to
+// inject them from a sops-encrypted file decrypted in memory at build time (no
+// plaintext on disk), and/or `buildArgs.values: { K: V }` for explicit pairs.
+async function resolveBuildArgs(image, cwd, { dryRun = false } = {}) {
   const cfg = image && image.buildArgs;
   if (!cfg) return [];
   const out = [];
   if (cfg.envFile) {
     const p = path.join(cwd, cfg.envFile);
-    if (fs.existsSync(p)) {
-      for (const line of fs.readFileSync(p, 'utf8').split('\n')) {
-        const m = line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/);
-        if (!m) continue;
-        const [, k, v] = m;
-        if (cfg.prefix && !k.startsWith(cfg.prefix)) continue;
-        out.push(`${k}=${stripQuotes(v)}`);
-      }
-    }
+    if (fs.existsSync(p)) out.push(...parseEnvLines(fs.readFileSync(p, 'utf8'), cfg.prefix));
+  }
+  if (cfg.sopsEnvFile) {
+    const { stdout } = await _run('sops', ['-d', '--output-type', 'dotenv', cfg.sopsEnvFile], { cwd, capture: true, dryRun });
+    out.push(...parseEnvLines(stdout || '', cfg.prefix));
   }
   for (const [k, v] of Object.entries(cfg.values || {})) out.push(`${k}=${v}`);
   return out;
 }
 
-module.exports = { resolveBuildArgs };
+module.exports = { resolveBuildArgs, _withRun };

package/src/core/engine.js

@@ -39,7 +39,7 @@ async function execute(steps, { dryRun = false, allowDirty = false, deps } = {})
       if (u._clone && !clones.includes(u._clone)) clones.push(u._clone);
       const cwd = u._clone ? u._clone.dir : u.repoPath;
       if (step.kind === 'deps') { if (d.depsCache.needsDepsRebuild(u.image, cwd, u.repo)) await d.docker.buildDeps(u.image, cwd, dryRun); }
-      else if (step.kind === 'build') await d.docker.buildImage({ ecrUri: u.repoUri, sha, dockerfile: u.image.dockerfile, context: u.image.context || '.', platform: u.defaults.platform, cwd, dryRun, buildArgs: d.buildArgs.resolveBuildArgs(u.image, cwd) });
+      else if (step.kind === 'build') await d.docker.buildImage({ ecrUri: u.repoUri, sha, dockerfile: u.image.dockerfile, context: u.image.context || '.', platform: u.defaults.platform, cwd, dryRun, buildArgs: await d.buildArgs.resolveBuildArgs(u.image, cwd, { dryRun }) });
       else if (step.kind === 'push') {
         if (!loggedIn) { await d.docker.ecrLogin({ account: u.defaults.account, region: u.defaults.region, profile: u.defaults.profile, dryRun }); await d.docker.ensureRepo({ ecr: u.image.ecr, account: u.defaults.account, region: u.defaults.region, profile: u.defaults.profile, dryRun }); loggedIn = true; }
         await d.docker.pushImage({ ecrUri: u.repoUri, sha, dryRun });