Ops Secret Sync

OPS ► SECRET-SYNC

Load ops-rules before acting. Public repo (no personal data). Outbound: one draft → one approval → one send. If AskUserQuestion / Workflow are missing, follow Rule 10 in ops-rules (Hermes: numbered options / two-turn Telegram card; delegate_task).

Detect GitHub secrets that are stale relative to Doppler. Confirm before syncing.

CLI/API Reference

Phase 1 — Resolve arguments

Parse $ARGUMENTS:

• --repo <owner/repo> → target GitHub repo (required unless registry provides default)
• --project <proj> → Doppler project name (required)
• --config <env> → Doppler config/environment, e.g. prd, stg (default: prd)
• --dry-run → report drift only, never write

If --repo is missing, load ${CLAUDE_PLUGIN_DATA_DIR:-$HOME/.claude/plugins/data/ops-ops-marketplace}/registry.json and let the user pick via AskUserQuestion (max 4 at a time).

If --project is missing, run:

bashCopy code
doppler projects --json 2>/dev/null | jq -r '.[].slug'

and let the user pick via AskUserQuestion (max 4 at a time).

Phase 2 — Fetch secret inventories

Run in parallel (background both, then collect):

bashCopy code
# GH secrets (names + last-updated timestamps, ISO-8601)
gh secret list --repo <owner/repo> --json name,updatedAt 2>/dev/null

bashCopy code
# Doppler secrets (names + metadata including updated_at)
doppler secrets --project <proj> --config <env> --json 2>/dev/null

Parse outputs:

GH format (array):

jsonCopy code
[{"name": "INNGEST_SIGNING_KEY", "updatedAt": "2026-04-23T09:12:00Z"}, ...]

Doppler format (object keyed by name):

jsonCopy code
{
  "INNGEST_SIGNING_KEY": {"computed": "...", "note": "", "rawValue": "...", "updatedAt": "2026-04-23T10:00:00Z"},
  ...
}

Note: Doppler's --json flag returns computed values inline. Use doppler secrets get <NAME> --plain only at sync time to avoid holding all values in memory.

Phase 3 — Drift detection

For each secret in Doppler:

1. Check if a GH secret with the same name exists.
2. If yes: compute delta = doppler_updated_at - gh_updated_at (seconds).
3. If delta > 86400 (24 hours): mark as DRIFTED.
4. If GH secret does NOT exist: mark as GH_MISSING (flag but do not auto-create — requires explicit user confirm).

Build drift report:

Copy code
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 OPS ► SECRET-SYNC — <repo> / <proj>/<config>
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

 Doppler secrets : <N>
 GH repo secrets : <M>
 Matched         : <K>
 DRIFTED (>24h)  : <D>
 GH missing      : <G>

 DRIFTED SECRETS
   <NAME>  Doppler: <date>  GH: <date>  delta: <Nd>
   ...

 GH MISSING (in Doppler but absent from GH)
   <NAME>
   ...

 IN SYNC (no action needed)
   <NAME>  last-synced: <date>
   ...
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

If --dry-run is set or no drift found: stop here and display report.

Phase 4 — Confirm before syncing (REQUIRED — never skip)

Rule 5 compliance: every secret write requires per-action confirmation.

If drift was found, ask:

Copy code
AskUserQuestion({
  title: "Sync stale GH secrets from Doppler?",
  question: "Found <D> drifted + <G> missing secrets for <repo>.\n\nSync all, pick specific ones, or skip?",
  options: [
    { value: "all",    label: "Sync all drifted + missing" },
    { value: "pick",   label: "Pick which secrets to sync" },
    { value: "drifted", label: "Sync drifted only (skip missing)" },
    { value: "skip",   label: "Skip — report only" }
  ]
})

On "Pick": present drifted secrets 4-at-a-time via AskUserQuestion checkboxes. Collect user selections. Proceed only with confirmed names.

On "Skip": stop. Print report path.

Phase 5 — Sync confirmed secrets

For each confirmed secret name:

bashCopy code
doppler secrets get <NAME> --project <proj> --config <env> --plain 2>/dev/null \
  | gh secret set <NAME> --repo <owner/repo>

After each write, verify:

bashCopy code
gh secret list --repo <owner/repo> --json name,updatedAt \
  | jq -r '.[] | select(.name == "<NAME>") | .updatedAt'

Confirm the updatedAt advanced. If it did not advance: report failure for that secret and continue with the rest.

Print per-secret outcome:

Copy code
  synced : INNGEST_SIGNING_KEY  (Doppler 2026-04-23 → GH updated)
  FAILED : SOME_KEY             (gh secret set exited non-zero)

Phase 6 — Summary

Copy code
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 SYNC COMPLETE — <repo>
 Synced  : <S> secrets
 Failed  : <F> secrets
 Skipped : <K> secrets
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

If failures > 0: suggest doppler run --project <proj> --config <env> -- gh secret set <NAME> --repo <repo> as a manual fallback.

Example: recurring drift pattern

This skill exists because of a common drift pattern:

Running /ops:secret-sync --repo <your-org>/<your-api> --project <your-api> --config prd would have surfaced INNGEST_SIGNING_KEY as DRIFTED before CI failed.

Safety rules

• Never read or print raw secret values in the summary or logs.
• Never sync without user confirmation (Rule 5).
• Doppler values flow directly from doppler secrets get --plain into gh secret set via a pipe — they are never stored in shell variables, temp files, or command substitution.
• --dry-run always safe: no writes, report only.

Mobile / SSH (Rule 7)

When $SSH_CONNECTION / $OPS_MOBILE=1 / $COLUMNS < 80: skip the banner, emit compact lines:

Copy code
repo: your-org/example-project-api  project: example-project-api/prd
drifted: 2  missing: 1
INNGEST_SIGNING_KEY  doppler: 2026-04-23  gh: 2026-03-30  (24d stale)
CEREBRAS_API_KEY     gh: MISSING