@smi-digital/create-smi-app 2.9.1 → 2.9.2

package/dist/index.js

@@ -702,21 +702,23 @@ async function activateVaultFilter(projectRoot) {
   } catch {
     return;
   }
-  const setFilter = async (key, value) => runCommandQuiet(
-    "git",
-    ["config", `filter.ansible-vault.${key}`, value],
-    projectRoot
-  );
+  const setConfig = async (key, value) => runCommandQuiet("git", ["config", key, value], projectRoot);
   try {
-    await setFilter(
-      "clean",
-      "ansible-vault encrypt --vault-password-file .vault-password --output=- -"
-    );
-    await setFilter(
-      "smudge",
+    await setConfig("filter.ansible-vault.clean", "sh .gitvault/clean.sh %f");
+    await setConfig(
+      "filter.ansible-vault.smudge",
       "ansible-vault decrypt --vault-password-file .vault-password --output=- -"
     );
-    await setFilter("required", "true");
+    await setConfig("filter.ansible-vault.required", "true");
+    await setConfig(
+      "merge.ansible-vault.name",
+      "Ansible-Vault aware 3-way merge"
+    );
+    await setConfig(
+      "merge.ansible-vault.driver",
+      "sh .gitvault/merge.sh %O %A %B %P"
+    );
+    await setConfig("diff.ansible-vault.textconv", "sh .gitvault/textconv.sh");
   } catch {
     console.warn(
       "Could not configure the Ansible-Vault git filter automatically. Run `npm run setup:vault` before committing."

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smi-digital/create-smi-app",
-  "version": "2.9.1",
+  "version": "2.9.2",
   "description": "",
   "main": "dist/index.js",
   "bin": {

package/templates/base/package.json.template

@@ -9,7 +9,7 @@
     "prettier": "npx prettier --write .",
     "lint": "npx eslint .",
     "prepare": "husky",
-    "setup:vault": "git config filter.ansible-vault.clean \"ansible-vault encrypt --vault-password-file .vault-password --output=- -\" && git config filter.ansible-vault.smudge \"ansible-vault decrypt --vault-password-file .vault-password --output=- -\" && git config filter.ansible-vault.required true && echo '✅ Ansible-Vault Git Filters configured successfully!'",
+    "setup:vault": "git config filter.ansible-vault.clean 'sh .gitvault/clean.sh %f' && git config filter.ansible-vault.smudge 'ansible-vault decrypt --vault-password-file .vault-password --output=- -' && git config filter.ansible-vault.required true && git config merge.ansible-vault.name 'Ansible-Vault aware 3-way merge' && git config merge.ansible-vault.driver 'sh .gitvault/merge.sh %O %A %B %P' && git config diff.ansible-vault.textconv 'sh .gitvault/textconv.sh' && echo '✅ Ansible-Vault Git filters configured successfully!'",
     "knip": "knip",
     "depcruise": "depcruise . --exclude \"node_modules|dist|.husky|test\"",
     "depcheck": "npm run knip && npm run depcruise",

package/templates/integrations/strapi-astro/.gitattributes.template

@@ -1,2 +1,6 @@
 # Use Ansible-Vault Git filters for production environment files
 production.*.env filter=ansible-vault diff=ansible-vault merge=ansible-vault
+
+# The vault filter/merge/diff helpers are invoked as shell scripts; force LF so a
+# CRLF checkout on Windows can't break them.
+.gitvault/*.sh text eol=lf

package/templates/integrations/strapi-astro/.gitvault/clean.sh.template

@@ -0,0 +1,41 @@
+#!/bin/sh
+# Idempotent Ansible-Vault "clean" filter (encrypt on the way INTO git).
+#
+# Why this exists: `ansible-vault encrypt` uses a random salt, so encrypting the
+# same plaintext twice produces DIFFERENT ciphertext. With a naive clean filter
+# git re-encrypts on every status/diff/checkout and therefore ALWAYS sees the
+# file as "modified" — phantom diffs, salt-only churn baked into history, and
+# rebases/stashes that conflict on the ciphertext.
+#
+# This wrapper makes the filter deterministic: if the plaintext is unchanged
+# from what is already committed, it re-emits the EXISTING ciphertext verbatim
+# (no re-salt), so git sees no change. Only a real plaintext edit re-encrypts.
+#
+# Invoked by git as:  sh .gitvault/clean.sh %f   (%f = repo-relative path)
+#   stdin  = working-tree plaintext
+#   stdout = ciphertext to store in the index/commit
+set -eu
+
+path="${1:-}"
+pwfile=".vault-password"
+
+new="$(mktemp)"
+old_cipher="$(mktemp)"
+old_plain="$(mktemp)"
+trap 'rm -f "$new" "$old_cipher" "$old_plain"' EXIT
+
+cat > "$new"
+
+# The ciphertext already recorded for this path in the index (if any). Missing on
+# a first add, or unreadable if it was committed as plaintext once — both cases
+# fall through to a fresh encrypt.
+if [ -n "$path" ] \
+  && git cat-file -p ":$path" > "$old_cipher" 2>/dev/null \
+  && ansible-vault decrypt --vault-password-file "$pwfile" --output=- "$old_cipher" > "$old_plain" 2>/dev/null \
+  && cmp -s "$new" "$old_plain"; then
+  # Plaintext identical to what's stored → reuse the stored ciphertext (no re-salt).
+  cat "$old_cipher"
+else
+  # New file or a genuine plaintext change → encrypt fresh.
+  ansible-vault encrypt --vault-password-file "$pwfile" --output=- "$new"
+fi

package/templates/integrations/strapi-astro/.gitvault/merge.sh.template

@@ -0,0 +1,42 @@
+#!/bin/sh
+# Ansible-Vault aware merge driver — merges at the PLAINTEXT level.
+#
+# Git's default merge would 3-way-merge the opaque ciphertext and conflict on
+# nearly everything (different salts even when the plaintext agrees). This driver
+# decrypts the three inputs, runs a normal 3-way text merge, then RE-ENCRYPTS the
+# result. Git stores %A's bytes verbatim and then runs the smudge filter on them,
+# so %A must contain CIPHERTEXT (verified behaviour).
+#
+# Invoked by git as:  sh .gitvault/merge.sh %O %A %B %P
+#   %O = common-ancestor (base) ciphertext file
+#   %A = our version ciphertext file  (ALSO the output file git reads back)
+#   %B = their version ciphertext file
+#   %P = the real pathname (used only for conflict-marker labels)
+# Exit 0 = clean merge; non-zero = conflict (git marks the path unmerged, then
+# smudges %A so the working tree shows readable plaintext conflict markers).
+set -eu
+
+base="$1"; ours="$2"; theirs="$3"; path="${4:-file}"
+pwfile=".vault-password"
+
+# Decrypt $1 to stdout; if it isn't vault-encrypted (e.g. an empty base), pass
+# it through unchanged so the merge still has something to work with.
+dec() {
+  ansible-vault decrypt --vault-password-file "$pwfile" --output=- "$1" 2>/dev/null || cat "$1"
+}
+
+o="$(mktemp)"; a="$(mktemp)"; b="$(mktemp)"
+trap 'rm -f "$o" "$a" "$b"' EXIT
+dec "$base"   > "$o"
+dec "$ours"   > "$a"
+dec "$theirs" > "$b"
+
+# 3-way merge on plaintext, written in place into "$a". Returns the conflict
+# count (0 = clean); capture it instead of letting `set -e` abort.
+status=0
+git merge-file -L "ours ($path)" -L "base ($path)" -L "theirs ($path)" "$a" "$o" "$b" || status=$?
+
+# Re-encrypt the (possibly conflict-marked) result back into %A as ciphertext.
+ansible-vault encrypt --vault-password-file "$pwfile" --output=- "$a" > "$ours"
+
+exit "$status"

package/templates/integrations/strapi-astro/.gitvault/textconv.sh.template

@@ -0,0 +1,10 @@
+#!/bin/sh
+# Ansible-Vault diff textconv: render a vault file as plaintext for `git diff`.
+#
+# git applies this to BOTH sides of a diff — the committed blob (ciphertext) and
+# the working-tree copy (already decrypted by the smudge filter). So decrypt when
+# possible and fall back to cat when the input isn't vault-encrypted, otherwise
+# the working-tree side errors with "Input is not vault encrypted data".
+#
+# Invoked by git as:  sh .gitvault/textconv.sh <path>
+ansible-vault decrypt --vault-password-file .vault-password --output=- "$1" 2>/dev/null || cat "$1"

package/templates/integrations/strapi-astro/integration.config.json

@@ -81,6 +81,18 @@
       "template": ".gitattributes.template",
       "target": ".gitattributes"
     },
+    {
+      "template": ".gitvault/clean.sh.template",
+      "target": ".gitvault/clean.sh"
+    },
+    {
+      "template": ".gitvault/merge.sh.template",
+      "target": ".gitvault/merge.sh"
+    },
+    {
+      "template": ".gitvault/textconv.sh.template",
+      "target": ".gitvault/textconv.sh"
+    },
     {
       "template": "production.frontend.env.template",
       "target": "production.frontend.env"