Writing · sops

A secrets-only merge can produce no workflow run at all: the paths filter decides whether a run exists, the scope job decides which hosts it reaches.

Ciphertext in git, plaintext at activation. The sops store protects the repository, so the leak this fleet actually had was a running system quoted into a log.

If the credential that unwraps your backup lives inside it, a total host loss leaves an archive nobody can open. Escrow the identity, then test the restore.