[TEST] yaml-diff: SOPS *.enc.yaml excluded#136
Closed
weatherhog wants to merge 2 commits into
Closed
Conversation
Changes a real ConfigMap value AND touches a SOPS-encrypted *.enc.yaml in the same PR. The yaml-diff bot should diff only the ConfigMap and silently exclude the .enc.yaml. Throwaway test PR for roadmap#4121.
weatherhog
added a commit
to giantswarm/github-workflows
that referenced
this pull request
Jun 30, 2026
The default exclude_paths includes `**/*.enc.yaml`, but should_exclude() had no branch for the `**/<glob>` shape: a pattern containing `/` but not ending in `/**` fell through to the final `[[ "$path" == "$g" ]]` exact (quoted, non-glob) comparison, which never matched. As a result SOPS- encrypted files were NOT excluded and their diffs were posted as PR comments — the opposite of the documented behaviour. Add a branch that handles `**/<glob>` by matching <glob> against the basename at any depth, so `**/*.enc.yaml` matches `.../secret.enc.yaml`. Verified with a unit test of should_exclude over SOPS / .github / regular paths, and end-to-end against giantswarm/gitops-template#136. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Temporary: references the github-workflows fix/yaml-diff-enc-exclusion branch to confirm *.enc.yaml is now excluded. Throwaway test PR.
|
Semantic YAML source diff — key reordering without value changes is ignored. OutputSuppress with |
Validation output log |
Rendered manifest diff output log |
Contributor
Author
|
Closing — throwaway Phase-1 verification PR for roadmap#4121. All the work it exercised is merged: the yaml-diff bot, the SOPS-exclusion fix (giantswarm/github-workflows#231), colour output (#232), and the CI extraction (#233 + #139). Key-ordering removal is in #140. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Throwaway test PR for the yaml-diff bot rollout — roadmap#4121. Do not merge; close after verifying.
What this tests
Two files change in one PR:
data.values).secret.enc.yaml(touchedsops.lastmodified).Expected
yaml-diffbot comment shows only the ConfigMap diff.*.enc.yamlis not mentioned (matched by the default**/*.enc.yamlexclude). SOPS files must never be diffed.