Sops: Is there a way to integrate with Visual Studio Code?

[richstokes]

Can Visual Studio Code seamlessly decrypt and re-encrypt when opening/editing sops-protected files?

Or is the only option to decrypt these manually before trying to edit in VS?

[ajvb]

If you are running a *nix OS, then you just need to have your $EDITOR env var set to vscode and you can run sops -e <file> and it should open it up decrypted and re-encrypt on save/close. This _should_ work on Windows as well, just with the windows equivalent env var.

[richstokes]

Thanks, unfortunately thats pretty clunky as it means I'd have to do that every time I need to open a yaml file (I manage 100s of them). So would have to run a sops command to open each one outside of the UI.

I wonder how tricky it is to write an extension for VSCode that would do this automagically

[autrilla]

You could set $EDITOR to code, I guess. IDK how it behaves, but this from the docs might be helpful:

Editing will happen in whatever $EDITOR is set to, or, if it's not set, in vim. Keep in mind that sops will wait for the editor to exit, and then try to reencrypt the file. Some GUI editors (atom, sublime) spawn a child process and then exit immediately. They usually have an option to wait for the main editor window to be closed before exiting. See #127 for more information.

[poelzi]

There is an abandoned vscode-sops plugin, but never tried it

[r0bnet]

There is an abandoned vscode-sops plugin, but never tried it

It's not even existing on GitHub anymore so i think we can't expect any updates here soon ;)

I'm currently playing with sops in combination with Azure Key Vault. Works as expected. Only problem currently is that somehow behaves in a way that i don't understand.
I set the $EDITOR env var on my mac to code. When i'm typing sops <filename> it tries to open the file in VS Code but the content is empty. Surprisingly this is the output of the console:

$ sops config.yaml 
File has not changed, exiting.

I guessed that it's related to auto save function that i have enabled in VS Code but even after i turned it off it's the same behavior. Any idea?

(works with vim and nano without any problems)

// UPDATE:
Found this in a different issue:

EDITOR="code --wait"

Works like a charm

[richstokes]

Yep, that works. Only nice-to-have that I was getting at with this ticket would be auto decrypt via the GUI, rather than having to manually open each file via the command line. Thats not really a sops issue though

[ajvb]

Also, in https://github.com/mozilla/sops/issues/380#issuecomment-591018727 misak113 posted a link to https://marketplace.visualstudio.com/items?itemName=signageos.signageos-vscode-sops

[heinrichreimer]

I can confirm, setting the EDITOR environment variable to code --wait solves it even on VS Code for Windows.