feat: add keychain CLI commands#835
Merged
Merged
Conversation
…gration - import <file> positional (required) replaces the --from flag - default rewrites the source file in place (plaintext -> keychain refs); --write redirects refs to a different file and leaves the source untouched - fix: scan the source file's directory so sibling .env.schema is discovered (single-file load never surfaced the schema, so import always errored) - fix: resolve env values before reading isSensitive, so only schema-sensitive values are imported (pre-resolution every item reports sensitive)
Make it structural (and tested) that import stores the value from the input file's own AST, not the env graph's resolved value (which a sibling file like .env.local could override). Graph is consulted only for sensitivity.
Contributor
|
The changes in this PR will be included in the next version bump.
|
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
varlock-website | a72098e | Commit Preview URL Branch Preview URL |
Jun 25 2026, 12:34 AM |
Instead of scanning the source file's directory, load the project graph the normal way (respecting package.json varlock.loadPath) and locate the file via its FileBasedDataSource, like `encrypt --file`. Values are read from the file's own configItemDefs, so an override in a sibling file (.env.local) can't change what gets stored.
commit: |
…rrupted import - set: check for an existing Keychain item before prompting for the secret - import: if a write fails mid-run, report how many were imported and that remaining plaintext can be re-imported with --force
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Supersedes #820 (original work by @bjesuiter) — rebased onto
mainand pushed to this repo so it can be iterated on without the fork.Adds a native
varlock keychainCLI namespace for managing macOS Keychain-backed secrets, built on gunshi subcommands (matchingcache):keychain list— metadata-only view of matching Keychain items (filter +--keychain)keychain set— store a secret (masked prompt or stdin) and optionally write a matchingkeychain(...)ref with--write-tokeychain import <file>— migrate sensitive plaintext values into Keychain. Edits the file in place by default (replacing each plaintext value with itskeychain(...)ref);--write-toredirects refs to a different file and leaves the source untouchedkeychain fix-access— grant Varlock's helper access to existingkeychain(...)refs (by--accountor--path)Includes the Swift daemon actions (
keychain-set,keychain-fix-access) with stable error codes, plus docs and tests.Fixes beyond the original
importnow loads the project env graph normally (respectingpackage.jsonvarlock.loadPath) and locates the source file via itsFileBasedDataSource, mirroringencrypt --file. Previously it loaded just the single file and always errored "without .env.schema".importresolves the env graph before reading sensitivity (sensitivity is only finalized during resolution, so it was importing non-sensitive values), and stores the value from the input file's own parsed def rather than a resolved/overridden graph value (e.g. a.env.localoverride).