@smi-digital/create-smi-app 2.1.0 → 2.2.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smi-digital/create-smi-app",
-  "version": "2.1.0",
+  "version": "2.2.0",
   "description": "",
   "main": "dist/index.js",
   "bin": {

package/templates/.husky/pre-commit

@@ -3,7 +3,7 @@
 # 1. Run standard linters and formatters
 npx lint-staged
 
-# 2. Ansible-Vault Security Guard
+# 2. Ansible-Vault Auto-Encryptor
 # Find any staged files that end in .env and start with "production"
 STAGED_ENV_FILES=$(git diff --cached --name-only --diff-filter=ACM | grep -E '^production\..*\.env$')
 
@@ -11,18 +11,21 @@ for file in $STAGED_ENV_FILES; do
   # Read the first line of the file
   FIRST_LINE=$(head -n 1 "$file")
   
-  # Check if the first line indicates it is an Ansible Vault file
+  # Check if the first line indicates it is already an Ansible Vault file
   if [[ "$FIRST_LINE" != "\$ANSIBLE_VAULT;"* ]]; then
-    echo ""
-    echo "🚨 SECURITY ALERT: Unencrypted Production Secrets Detected! 🚨"
-    echo "File: $file"
-    echo ""
-    echo "You are attempting to commit a plain-text production .env file."
-    echo "Please encrypt it using Ansible-Vault before committing:"
-    echo ""
-    echo "  ansible-vault encrypt $file"
-    echo ""
-    echo "Commit aborted."
-    exit 1
+    echo "🔒 Auto-encrypting production secrets for: $file"
+    
+    # Check if .vault-password exists
+    if [ ! -f ".vault-password" ]; then
+      echo "❌ ERROR: .vault-password file not found. Cannot encrypt secrets."
+      echo "Please create a .vault-password file containing your master password."
+      exit 1
+    fi
+
+    # Encrypt the file using the local password
+    ansible-vault encrypt "$file" --vault-password-file .vault-password
+    
+    # Re-stage the now-encrypted file
+    git add "$file"
   fi
 done