Recover from a failed secrets-init instead of skipping silently

[Gerrrt]

Reported from the monitoring host, one step after #6:

$ make secrets-edit
sops secrets/observability.sops.yaml
sops metadata not found

Two failures compounding

The original broken script redirected sops stdout into the destination:

sops --encrypt secrets/observability.example.yaml > secrets/observability.sops.yaml

Shell redirection creates the file before the command runs — so when sops failed with "no matching creation rules found", it had already left a 0-byte secrets/observability.sops.yaml behind.

The fixed script from #6 then tested only [[ -f "${SECRETS_FILE}" ]], found that empty file, reported "already exists — leaving it alone", and did nothing. make secrets-init appeared to succeed while creating nothing, and the failure surfaced one step later as an unhelpful sops error.

"Exists" is not "set up"

Four states, four answers:

State	Action
exists but not readable	refuse — state is unknown, do not delete
exists, contains a sops: block	genuinely done — left alone
exists, non-empty, not encrypted	refuse and explain — never delete
absent, or an empty leftover	remove the empty file and create properly

The unreadable case (from review)

[[ -s FILE ]] is a stat, not a read, so it succeeds on a file the process cannot open. A chmod 000 secrets file therefore fell through to the "not SOPS-encrypted" branch — whose remediation tells you to delete it, on a file whose contents were never inspected and which may be perfectly good ciphertext.

Readability is now checked before anything tries to read. Demonstrated against a real sops:-bearing file at mode 000, run as nobody:

old:  -> "not SOPS-encrypted" + advises: rm the file
new:  -> "not readable" (state unknown, do not delete)

As root the branch cannot be exercised at all, since root reads anything — which is exactly why the earlier testing missed it. The grep also no longer swallows stderr, so a genuine read error stays visible instead of being silently reclassified.

Pasteable paths (from review)

The paths printed in those errors are meant to be copied, so they are %q-quoted and rm takes --. Unquoted, a stack name containing a space or a glob produced a command acting on something else:

raw:    rm -- /home/u/my stack/secrets/obs*.sops.yaml
        -> [rm] [--] [/home/u/my] [stack/secrets/obs*.sops.yaml]
quoted: rm -- /home/u/my\ stack/secrets/obs\*.sops.yaml
        -> [rm] [--] [/home/u/my stack/secrets/obs*.sops.yaml]

The non-empty unencrypted case

Deliberately never deleted — it could be real credentials written by hand and not yet encrypted. The error offers both paths:

If it holds real values you want to keep, encrypt it in place:
  sops --encrypt --in-place secrets/observability.sops.yaml

If it is junk from a failed run, remove it and re-run:
  rm -- secrets/observability.sops.yaml && make secrets-init

Verification

Tested against a clone rolled back to the broken script, so the reproduction is the real sequence rather than a synthetic one:

• 0-byte leftover → removed, replaced with a genuinely encrypted file (size=0 → size=5817, sops: block present)
• already-encrypted file → byte-identical afterwards (checksum unchanged)
• non-empty unencrypted file → refused, contents fully intact
• encrypted-but-unreadable file, as nobody → refused without deleting; old code would have advised removing it

On the host

After this merges:

git pull
make secrets-init     # clears the empty leftover and creates the real file
make secrets-edit

Or unblock immediately without waiting — the leftover is a 0-byte file, so nothing is lost:

rm secrets/observability.sops.yaml
make secrets-init

[Copilot]

🟡 Not ready to approve

The new state detection hides certain underlying file-read errors and includes unquoted remediation commands that could mislead or be unsafe to copy/paste in edge cases.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.

Pull request overview

This PR improves scripts/bootstrap.sh so make secrets-init can reliably recover from prior failed runs (notably the 0-byte leftover secrets file scenario) instead of silently skipping and failing later during make secrets-edit.

Changes:

• Detect “already set up” secrets by checking for a sops: metadata block, not just file existence.
• Refuse to overwrite non-empty, non-encrypted secrets files (to avoid destroying potential real credentials) and provide remediation steps.
• Automatically remove empty leftover secrets files and recreate them properly from the template.

File summaries

File	Description
scripts/bootstrap.sh	Adds robust state detection for the secrets file (encrypted vs plaintext vs empty leftover) and safer recovery behavior during bootstrap.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 2
• Review effort level: Lite

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.