Vaulted Secrets Without Git Churn
Ansible Vault keeps secrets out of sight, but the ciphertext changes on every
encrypt. That turns Git [1] diffs into noise and makes it hard to tell if anything
actually changed. Decrypting, editing, and re-encrypting often leaves
uncertainty about whether any plaintext changed. This is amplified when secret
repos are tightly coupled to dependent repositories. A typical cycle includes
decrypting, adding a key, updating a value, applying changes, and returning
later with little clarity about what changed while secrets were in plaintext.
Today a new workflow was created with @gpt-5.2-codex to keep diffs clean and
avoid re-encrypting when the plaintext is identical.
Chat-reply
This repo has ansible vaulted secrets and an encrypt/decrypt process, but no
way to compare. Please research compare options. The goal is to avoid
changing files on encrypt/decrypt when plaintext is unchanged, ideally by
comparing decrypted content and reusing the remote encrypted file.
@gpt-5.2-codex
The re...