@intentius/chant-lexicon-k8s 0.45.0 → 0.49.0

package/src/secret-store.ts

@@ -0,0 +1,165 @@
+/**
+ * The Kubernetes row of the secret-store seam (chant #1830, epic #1365) — a
+ * `SecretStoreAdapter` over the typed client, for the `ensure-secret`
+ * capability verb and the `ensureSecret(...)` op step (both #1829, both
+ * surfaces over core's one materialization engine).
+ *
+ * The constitutional line, held structurally:
+ *
+ * - `exists` and `describe` read the live Secret and report key NAMES and
+ *   labels/annotations only. The `data` values are projected to their key
+ *   names inside one function frame and the object is dropped — nothing
+ *   value-shaped is returned, logged, or retained. The mismatch check in core
+ *   therefore has nothing to compare but names, by construction.
+ * - `create` is the only writer. It redeems each key's material through
+ *   `consumeSecretMaterial` AT the write — the engine hands the generator
+ *   through this seam and never calls it — and returns nothing.
+ *
+ * Every minted Secret carries chant's ownership marker plus the
+ * `chant.intentius.io/generated-once` label (./secret-labels.ts), which is
+ * what both prune paths key their `retained` outcome on: a generated-once
+ * Secret is never in any prunable set, because the stored bytes are the only
+ * copy of material chant never held.
+ *
+ * Not exported from the package entry point — like ./teardown.ts, this module
+ * names the API client, which must stay off the build path (chant #1074,
+ * examples/k8s-client-boundary.test.ts). Consumers reach it by subpath:
+ * `@intentius/chant-lexicon-k8s/secret-store`.
+ */
+
+import type {
+  SecretMaterialGenerator,
+  SecretStoreAdapter,
+  SecretStoreDescription,
+} from "@intentius/chant/secret-materialization";
+import { consumeSecretMaterial } from "@intentius/chant/secret-materialization";
+import {
+  createEnsureSecretCapability,
+  type EnsureSecretInput,
+  type EnsureSecretOutput,
+} from "@intentius/chant/components/verbs/ensure-secret";
+import type { Capability } from "@intentius/chant/components/capability";
+import {
+  LABEL_OWNERSHIP_KEYS,
+  OWNERSHIP_MANAGED_BY_VALUE,
+  ownershipEntries,
+  type OwnershipMarker,
+} from "@intentius/chant/ownership";
+import type { K8sClient, K8sObject } from "@intentius/chant-k8s-client";
+import { defaultK8sConnector, type K8sConnector } from "./api/connect";
+import { GENERATED_ONCE_LABEL_KEY, GENERATED_ONCE_LABEL_VALUE } from "./secret-labels";
+
+const SECRET_REF = { apiVersion: "v1", kind: "Secret" } as const;
+
+export interface K8sSecretStoreOptions {
+  /**
+   * Ownership identity to stamp on a minted Secret, next to the
+   * generated-once label. Omitted stamps `managed-by=chant` alone — the
+   * Secret is still chant-owned and still never prunable.
+   */
+  marker?: OwnershipMarker;
+  /** chant environment, resolved through `k8s.profiles.<env>.context` when no client is handed in. */
+  environment?: string;
+  /** Explicit kubectl context, for the op write path. */
+  context?: string;
+  /** Project directory whose `chant.config.ts` carries the k8s profiles. Defaults to cwd. */
+  cwd?: string;
+  /** The connector to build a client with when none is handed in. Test seam. */
+  connect?: K8sConnector;
+}
+
+/**
+ * Build the k8s `SecretStoreAdapter` for one namespace.
+ *
+ * Pass a `client` where the caller already holds one (an activity that
+ * connected for the rest of its work); omit it and the adapter connects
+ * lazily through the same environment→cluster binding every other k8s path
+ * uses (./api/connect.ts).
+ */
+export function k8sSecretStore(
+  namespace: string,
+  client?: K8sClient,
+  options: K8sSecretStoreOptions = {},
+): SecretStoreAdapter {
+  let pending: Promise<K8sClient> | undefined = client ? Promise.resolve(client) : undefined;
+  const clientOf = (): Promise<K8sClient> =>
+    (pending ??= (options.connect ?? defaultK8sConnector)({
+      ...(options.environment !== undefined ? { environment: options.environment } : {}),
+      ...(options.context !== undefined ? { context: options.context } : {}),
+      ...(options.cwd !== undefined ? { cwd: options.cwd } : {}),
+    }).then((connected) => connected.client));
+
+  return {
+    async exists(name: string): Promise<boolean> {
+      const c = await clientOf();
+      return (await c.readIfPresent({ ...SECRET_REF, name, namespace })) !== undefined;
+    },
+
+    async describe(name: string): Promise<SecretStoreDescription> {
+      const c = await clientOf();
+      const live = await c.read({ ...SECRET_REF, name, namespace });
+      // Project key names and drop the object in the same frame. The values
+      // exist only in `live`, which nothing below touches again — the return
+      // carries names and metadata, never a byte of `data`.
+      const keys = Object.keys((live.data as Record<string, unknown> | undefined) ?? {}).sort();
+      const metadata: Record<string, string> = {
+        ...(live.metadata?.annotations ?? {}),
+        ...(live.metadata?.labels ?? {}),
+      };
+      return { keys, metadata };
+    },
+
+    async create(name: string, keys: readonly string[], generate: SecretMaterialGenerator): Promise<void> {
+      const c = await clientOf();
+      // Mint and consume per key, at the write. `consumeSecretMaterial` burns
+      // each handle, so the material cannot be redeemed a second time by
+      // anything, this adapter included.
+      const data: Record<string, string> = {};
+      for (const key of keys) {
+        data[key] = Buffer.from(consumeSecretMaterial(await generate(key)), "utf-8").toString("base64");
+      }
+      const secret: K8sObject = {
+        apiVersion: SECRET_REF.apiVersion,
+        kind: SECRET_REF.kind,
+        metadata: {
+          name,
+          namespace,
+          labels: {
+            ...(options.marker
+              ? ownershipEntries(LABEL_OWNERSHIP_KEYS, options.marker)
+              : { [LABEL_OWNERSHIP_KEYS.managedBy]: OWNERSHIP_MANAGED_BY_VALUE }),
+            [GENERATED_ONCE_LABEL_KEY]: GENERATED_ONCE_LABEL_VALUE,
+          },
+        },
+        type: "Opaque",
+        data,
+      };
+      // Server-side apply as chant's field manager — the same write path every
+      // other chant mutation takes. The result (which echoes `data`) is
+      // deliberately discarded.
+      await c.apply(secret, {
+        ...(options.marker ? { fieldManager: `chant:${options.marker.stack}` } : {}),
+      });
+    },
+  };
+}
+
+/**
+ * The real `ensure-secret` capability for a Kubernetes namespace — core's
+ * factory (#1829) over this module's adapter. Replaces the starter set's
+ * typed stub for a project whose secret store is the cluster:
+ *
+ * ```ts
+ * registry.register(k8sEnsureSecretCapability("prod", undefined, {
+ *   marker: { stack: "shop", env: "prod" },
+ *   environment: "prod",
+ * }));
+ * ```
+ */
+export function k8sEnsureSecretCapability(
+  namespace: string,
+  client?: K8sClient,
+  options: K8sSecretStoreOptions = {},
+): Capability<EnsureSecretInput, EnsureSecretOutput> {
+  return createEnsureSecretCapability({ store: k8sSecretStore(namespace, client, options) });
+}

package/src/serializer.ts

@@ -15,6 +15,7 @@ import { walkValue, type SerializerVisitor } from "@intentius/chant/serializer-w
 import { emitYAML } from "@intentius/chant/yaml";
 import { isDefaultLabels, isDefaultAnnotations, type DefaultLabels, type DefaultAnnotations } from "./default-labels";
 import { isRenderedManifestEntity } from "./kustomize/rendered-entity";
+import { isEncryptedSecretFileEntity } from "./sops/entity";
 
 const require = createRequire(import.meta.url);
 
@@ -225,7 +226,11 @@ export const k8sSerializer: Serializer = {
   // `chant-disable ARGO001` already written (#1349).
   extraRulePrefixes: ["ARGO", "FLUX"],
 
-  serialize(entities: Map<string, Declarable>, _outputs?: LexiconOutput[], context?: SerializeContext): string {
+  serialize(
+    entities: Map<string, Declarable>,
+    _outputs?: LexiconOutput[],
+    context?: SerializeContext,
+  ): string | SerializerResult {
     // Build reverse map: entity → name
     const entityNames = new Map<Declarable, string>();
     for (const [name, entity] of entities) {
@@ -251,11 +256,33 @@ export const k8sSerializer: Serializer = {
 
     const namespaceDocs: string[] = [];
     const otherDocs: string[] = [];
+    /** Sidecar files — committed ciphertext, copied byte-for-byte. */
+    const files: Record<string, string> = {};
+    const warnings: string[] = [];
 
     for (const [name, entity] of entities) {
       if (isPropertyDeclarable(entity)) continue;
       if (isDefaultLabels(entity) || isDefaultAnnotations(entity)) continue;
 
+      // Committed SOPS ciphertext (epic lex00/iac-cd-bench#6) leaves as a
+      // SIDECAR and never as a document in the primary output. That is the
+      // load-bearing line: chant's appliers read the primary output, so an
+      // undecrypted Secret cannot reach a cluster through them. The bytes are
+      // copied exactly as committed — no re-emit, no label merge, no
+      // ownership stamp — because re-serializing would break the MAC the
+      // `sops` block carries over the plaintext.
+      if (isEncryptedSecretFileEntity(entity)) {
+        const existing = files[entity.filename];
+        if (existing !== undefined && existing !== entity.text) {
+          warnings.push(
+            `k8s: two committed-encrypted secrets emit the same sidecar filename ` +
+              `"${entity.filename}" — the second (${entity.sourcePath}) wins`,
+          );
+        }
+        files[entity.filename] = entity.text;
+        continue;
+      }
+
       // A kustomize build root's document (#1548 piece 3) is render-final:
       // the overlay decided every field, so the props ARE the manifest and
       // the spec-inference heuristics below (built for typed declarables)
@@ -386,7 +413,11 @@ export const k8sSerializer: Serializer = {
       }
     }
 
-    return [...namespaceDocs, ...otherDocs].join("\n---\n");
+    const primary = [...namespaceDocs, ...otherDocs].join("\n---\n");
+    // A bare string when there is nothing extra to write, so the common case
+    // stays byte-identical to what every existing consumer already reads.
+    if (Object.keys(files).length === 0 && warnings.length === 0) return primary;
+    return { primary, files, ...(warnings.length > 0 ? { warnings } : {}) };
   },
 };
 

package/src/sops/encrypted-secret-file.test.ts

@@ -0,0 +1,333 @@
+/**
+ * Committed SOPS ciphertext, end to end. What must hold: a
+ * committed-encrypted `declareSecret()` resolves its file at `buildRoots()`,
+ * the bytes leave the build BYTE-FOR-BYTE as a sidecar, the primary output
+ * never carries them, and every way the claim can be false — missing file,
+ * wrong name, no `sops` block, a value that is not `ENC[...]` — refuses with
+ * the path in the message and nothing emitted.
+ *
+ * The fixture (`../testdata/sops/db-credentials.sops.yaml`) is a real
+ * sops-shaped document: cleartext structure, `ENC[...]` values, an age
+ * recipient block and a `mac`. Nothing in this suite decrypts anything —
+ * there is no key, and no code path that could use one.
+ */
+import { describe, test, expect } from "vitest";
+import { fileURLToPath } from "node:url";
+import { dirname, join } from "node:path";
+import { readFileSync } from "node:fs";
+import { mkdir, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { build } from "@intentius/chant";
+import { declareSecret, type CommittedEncryptedSecretDeclaration } from "@intentius/chant/secret-provenance";
+import type { Declarable } from "@intentius/chant/declarable";
+import {
+  encryptedSecretBuildRoot,
+  resolveEncryptedSecrets,
+  validateEncryptedSecretDocument,
+  committedEncryptedDeclarations,
+} from "./encrypted-secret-file";
+import { isEncryptedSecretFileEntity, ENCRYPTED_SECRET_FILE_TYPE } from "./entity";
+import { k8sSerializer } from "../serializer";
+import { k8sPlugin } from "../plugin";
+
+const here = dirname(fileURLToPath(import.meta.url));
+const fixtureRoot = join(here, "..", "testdata", "sops");
+const FIXTURE = "db-credentials.sops.yaml";
+const FIXTURE_TEXT = readFileSync(join(fixtureRoot, FIXTURE), "utf-8");
+/** Absolute path to core's factory — a temp project cannot resolve "@intentius/chant". */
+const DECLARE_SECRET_MODULE = join(here, "..", "..", "..", "..", "packages", "core", "src", "secret-provenance");
+
+function declaration(
+  overrides: Partial<{ name: string; file: string }> = {},
+): CommittedEncryptedSecretDeclaration {
+  return declareSecret({
+    name: overrides.name ?? "db-credentials",
+    provenance: "committed-encrypted",
+    file: overrides.file ?? FIXTURE,
+    keys: ["POSTGRES_USER", "POSTGRES_PASSWORD"],
+  });
+}
+
+function declarations(...decls: CommittedEncryptedSecretDeclaration[]) {
+  return new Map(decls.map((d, i) => [`decl${i}`, d]));
+}
+
+describe("resolveEncryptedSecrets — the buildRoots read path", () => {
+  test("reads the committed bytes and wraps them in one entity", () => {
+    const entities = resolveEncryptedSecrets({
+      projectRoot: fixtureRoot,
+      declarations: declarations(declaration()),
+    });
+
+    expect([...entities.keys()]).toEqual(["sops:db-credentials"]);
+    const entity = entities.get("sops:db-credentials")!;
+    expect(isEncryptedSecretFileEntity(entity)).toBe(true);
+    if (!isEncryptedSecretFileEntity(entity)) return;
+    expect(entity.lexicon).toBe("k8s");
+    expect(entity.entityType).toBe(ENCRYPTED_SECRET_FILE_TYPE);
+    expect(entity.filename).toBe(FIXTURE);
+    expect(entity.secretName).toBe("db-credentials");
+    // The namespace is read from the file, not restated by the author — SOPS
+    // encrypts values, not structure, so metadata is cleartext.
+    expect(entity.namespace).toBe("apps");
+    expect(entity.text).toBe(FIXTURE_TEXT);
+  });
+
+  test("a declaration in a subdirectory keeps the basename as the sidecar name", () => {
+    const entities = resolveEncryptedSecrets({
+      projectRoot: join(fixtureRoot, ".."),
+      declarations: declarations(declaration({ file: `sops/${FIXTURE}` })),
+    });
+    const entity = [...entities.values()][0];
+    expect(isEncryptedSecretFileEntity(entity) && entity.filename).toBe(FIXTURE);
+  });
+
+  test("no committed-encrypted declarations contributes nothing", async () => {
+    const contribution = await encryptedSecretBuildRoot({ projectRoot: fixtureRoot, config: {} });
+    expect(contribution.entities.size).toBe(0);
+  });
+
+  test("the plugin hook resolves declarations from ctx.entities", async () => {
+    const contribution = await k8sPlugin.buildRoots!({
+      projectRoot: fixtureRoot,
+      config: {},
+      entities: new Map<string, Declarable>([["dbCredentials", declaration()]]),
+    });
+    expect([...contribution.entities.keys()]).toEqual(["sops:db-credentials"]);
+  });
+
+  test("committedEncryptedDeclarations ignores the other three kinds", () => {
+    const entities = new Map<string, Declarable>([
+      ["a", declareSecret({ name: "a", provenance: "referenced" })],
+      ["b", declareSecret({ name: "b", provenance: "generated-once", keys: ["k"] })],
+      ["c", declaration()],
+    ]);
+    expect([...committedEncryptedDeclarations(entities).keys()]).toEqual(["c"]);
+  });
+
+  test("a missing file refuses, naming the resolved path", () => {
+    expect(() =>
+      resolveEncryptedSecrets({
+        projectRoot: fixtureRoot,
+        declarations: declarations(declaration({ name: "gone", file: "nowhere.sops.yaml" })),
+      }),
+    ).toThrow(/not readable at .*nowhere\.sops\.yaml/);
+  });
+
+  test("two declarations whose paths share a basename refuse rather than overwrite", async () => {
+    const dir = join(tmpdir(), `chant-sops-collide-${Date.now()}-${Math.random()}`);
+    await mkdir(join(dir, "a"), { recursive: true });
+    await mkdir(join(dir, "b"), { recursive: true });
+    try {
+      await writeFile(join(dir, "a", "creds.sops.yaml"), FIXTURE_TEXT);
+      await writeFile(
+        join(dir, "b", "creds.sops.yaml"),
+        FIXTURE_TEXT.replace("name: db-credentials", "name: other-credentials"),
+      );
+      expect(() =>
+        resolveEncryptedSecrets({
+          projectRoot: dir,
+          declarations: declarations(
+            declaration({ file: "a/creds.sops.yaml" }),
+            declaration({ name: "other-credentials", file: "b/creds.sops.yaml" }),
+          ),
+        }),
+      ).toThrow(/collides/);
+    } finally {
+      await rm(dir, { recursive: true, force: true });
+    }
+  });
+});
+
+describe("validateEncryptedSecretDocument", () => {
+  const declared = { name: "db-credentials", file: FIXTURE };
+
+  test("the fixture is clean, and its key names (never values) are read back", () => {
+    const { problems, document } = validateEncryptedSecretDocument(FIXTURE_TEXT, declared);
+    expect(problems).toEqual([]);
+    expect(document!.name).toBe("db-credentials");
+    expect(document!.namespace).toBe("apps");
+    expect(document!.keys.sort()).toEqual(["POSTGRES_PASSWORD", "POSTGRES_USER"]);
+  });
+
+  test("a metadata.name other than the declared one is a problem", () => {
+    const text = FIXTURE_TEXT.replace("name: db-credentials", "name: other-credentials");
+    const { problems } = validateEncryptedSecretDocument(text, declared);
+    expect(problems.join("\n")).toMatch(/metadata\.name "other-credentials"/);
+  });
+
+  test("a document that is not a v1 Secret is a problem", () => {
+    const text = FIXTURE_TEXT.replace("kind: Secret", "kind: ConfigMap");
+    const { problems } = validateEncryptedSecretDocument(text, declared);
+    expect(problems.join("\n")).toMatch(/not a v1 Secret/);
+  });
+
+  test("a missing sops block is a problem — the file was never encrypted", () => {
+    const text = FIXTURE_TEXT.slice(0, FIXTURE_TEXT.indexOf("sops:"));
+    const { problems } = validateEncryptedSecretDocument(text, declared);
+    expect(problems.join("\n")).toMatch(/no top-level `sops` block/);
+  });
+
+  test("a plaintext data value is a problem, reported by KEY name only", () => {
+    const text = FIXTURE_TEXT.replace(
+      /POSTGRES_PASSWORD: ENC\[[^\]]*\]/,
+      "POSTGRES_PASSWORD: hunter2",
+    );
+    const { problems } = validateEncryptedSecretDocument(text, declared);
+    const message = problems.join("\n");
+    expect(message).toMatch(/stringData\."POSTGRES_PASSWORD" is not encrypted/);
+    // The constitutional line: a value is tested, never echoed.
+    expect(message).not.toContain("hunter2");
+  });
+
+  test("multi-document files are refused in v1", () => {
+    const { problems } = validateEncryptedSecretDocument(`${FIXTURE_TEXT}\n---\n${FIXTURE_TEXT}`, declared);
+    expect(problems.join("\n")).toMatch(/contains 2 YAML documents/);
+  });
+
+  test("unparseable YAML is refused, not thrown through", () => {
+    const { problems } = validateEncryptedSecretDocument("a:\n  - b\n c: [", declared);
+    expect(problems.length).toBe(1);
+    expect(problems[0]).toMatch(/not valid YAML/);
+  });
+
+  test("every problem is reported at once, not one per build", () => {
+    const text = FIXTURE_TEXT.replace("name: db-credentials", "name: wrong").replace(
+      /POSTGRES_USER: ENC\[[^\]]*\]/,
+      "POSTGRES_USER: postgres",
+    );
+    const { problems } = validateEncryptedSecretDocument(text, declared);
+    expect(problems.length).toBeGreaterThanOrEqual(2);
+  });
+
+  test("resolution refuses on any problem, emitting nothing", () => {
+    const dir = join(tmpdir(), `chant-sops-bad-${Date.now()}-${Math.random()}`);
+    return (async () => {
+      await mkdir(dir, { recursive: true });
+      try {
+        await writeFile(
+          join(dir, FIXTURE),
+          FIXTURE_TEXT.replace(/POSTGRES_USER: ENC\[[^\]]*\]/, "POSTGRES_USER: postgres"),
+        );
+        expect(() =>
+          resolveEncryptedSecrets({ projectRoot: dir, declarations: declarations(declaration()) }),
+        ).toThrow(/does not resolve[\s\S]*is not encrypted/);
+      } finally {
+        await rm(dir, { recursive: true, force: true });
+      }
+    })();
+  });
+});
+
+describe("sidecar emission", () => {
+  const workload: Declarable = {
+    lexicon: "k8s",
+    entityType: "K8s::Apps::Deployment",
+    kind: "resource",
+    props: {
+      metadata: { name: "api", namespace: "apps" },
+      spec: {
+        template: {
+          spec: {
+            containers: [
+              { name: "api", image: "api:1.0", envFrom: [{ secretRef: { name: "db-credentials" } }] },
+            ],
+          },
+        },
+      },
+    },
+    [Symbol.for("chant.declarable")]: true,
+  } as unknown as Declarable;
+
+  function serializeWithCiphertext() {
+    const entities = new Map<string, Declarable>([["api", workload]]);
+    for (const [name, entity] of resolveEncryptedSecrets({
+      projectRoot: fixtureRoot,
+      declarations: declarations(declaration()),
+    })) {
+      entities.set(name, entity);
+    }
+    return k8sSerializer.serialize(entities);
+  }
+
+  test("the ciphertext leaves as a sidecar file, byte for byte", () => {
+    const result = serializeWithCiphertext();
+    expect(typeof result).toBe("object");
+    if (typeof result === "string") return;
+    expect(Object.keys(result.files ?? {})).toEqual([FIXTURE]);
+    expect(result.files![FIXTURE]).toBe(FIXTURE_TEXT);
+  });
+
+  test("the primary output carries no ciphertext and no Secret document", () => {
+    const result = serializeWithCiphertext();
+    const primary = typeof result === "string" ? result : result.primary;
+    expect(primary).toContain("kind: Deployment");
+    expect(primary).not.toContain("ENC[");
+    expect(primary).not.toContain("kind: Secret");
+    expect(primary).not.toContain("sops");
+  });
+
+  test("a build with no ciphertext still returns a bare string — the common case is unchanged", () => {
+    const result = k8sSerializer.serialize(new Map<string, Declarable>([["api", workload]]));
+    expect(typeof result).toBe("string");
+  });
+
+  test("the whole path through build(): declaration in, sidecar out", async () => {
+    const dir = join(tmpdir(), `chant-sops-build-${Date.now()}-${Math.random()}`);
+    await mkdir(dir, { recursive: true });
+    try {
+      await writeFile(join(dir, FIXTURE), FIXTURE_TEXT);
+      await writeFile(
+        join(dir, "secrets.infra.ts"),
+        `import { declareSecret } from ${JSON.stringify(DECLARE_SECRET_MODULE)};
+export const dbCredentials = declareSecret({
+  name: "db-credentials",
+  provenance: "committed-encrypted",
+  file: ${JSON.stringify(FIXTURE)},
+  keys: ["POSTGRES_USER", "POSTGRES_PASSWORD"],
+});
+`,
+      );
+
+      const result = await build(dir, [k8sSerializer], undefined, {
+        buildRoots: [(ctx) => k8sPlugin.buildRoots!({ projectRoot: dir, config: {}, entities: ctx.entities })],
+      });
+
+      expect(result.errors).toEqual([]);
+      const output = result.outputs.get("k8s")!;
+      expect(typeof output).toBe("object");
+      if (typeof output === "string") return;
+      expect(output.files![FIXTURE]).toBe(FIXTURE_TEXT);
+      expect(output.primary).not.toContain("ENC[");
+    } finally {
+      await rm(dir, { recursive: true, force: true });
+    }
+  });
+
+  test("a broken declaration fails the build with a message, not a stack trace", async () => {
+    const dir = join(tmpdir(), `chant-sops-build-bad-${Date.now()}-${Math.random()}`);
+    await mkdir(dir, { recursive: true });
+    try {
+      await writeFile(
+        join(dir, "secrets.infra.ts"),
+        `import { declareSecret } from ${JSON.stringify(DECLARE_SECRET_MODULE)};
+export const dbCredentials = declareSecret({
+  name: "db-credentials",
+  provenance: "committed-encrypted",
+  file: "secrets/never-committed.sops.yaml",
+});
+`,
+      );
+
+      const result = await build(dir, [k8sSerializer], undefined, {
+        buildRoots: [(ctx) => k8sPlugin.buildRoots!({ projectRoot: dir, config: {}, entities: ctx.entities })],
+      });
+
+      expect(result.errors.length).toBe(1);
+      expect(result.errors[0].message).toContain("never-committed.sops.yaml");
+      expect(result.errors[0].message).toContain("not readable");
+    } finally {
+      await rm(dir, { recursive: true, force: true });
+    }
+  });
+});