SOPS Encrypt

Encrypt .env files by converting to YAML and encrypting with SOPS + age.

Why YAML? SOPS dotenv store has a known bug (#1435) that corrupts backslash and \n sequences. The helper script converts dotenv→YAML before encryption.

Workflow

1. Detect current state:

   python3 ${CLAUDE_SKILL_DIR}/../sops-setup/scripts/detect_sops.py <project-root>
   

2. Verify prerequisites:

   • tools.sops.installed must be true — if not, tell user to run /devtools:sops-setup
   • project.sops_yaml.exists must be true — if not, tell user to run /devtools:sops-setup
   • age_key.exists must be true — if not, tell user to run /devtools:sops-setup

3. Show unencrypted .env files from project.env_files. If empty, report "No .env files found to encrypt" and exit.