yuvipanda / pre-commit-hook-ensure-sops

pre-commit hook to ensure that files that should be encrypted with sops are
BSD 3-Clause "New" or "Revised" License
35 stars 19 forks source link

Error when running in CI/CD - GitHub Actions #22

Open rlinstorres opened 1 year ago

rlinstorres commented 1 year ago

Hi, there!

We are trying to implement this hook in our projects and it's working locally when pushing commits but when running in CI/CD, we are getting an error but the error message is not clear about what is the problem.

Our settings:

repos:
  - repo: https://github.com/yuvipanda/pre-commit-hook-ensure-sops
    rev: v1.1
    hooks:
      - id: sops-encryption

Running Locally:

Screenshot 2023-09-15 at 10 21 52 AM

Running in CI/CD:

Screenshot 2023-09-15 at 10 48 55 AM

This is the log:

Ensure secrets are encrypted with sops...................................Failed
- hook id: sops-encryption
- exit code: 1

Traceback (most recent call last):
  File "/usr/lib/python3.10/runpy.py", line 196, in _run_module_as_main
    return _run_code(code, main_globals, None,
  File "/usr/lib/python3.10/runpy.py", line 86, in _run_code
    exec(code, run_globals)
  File "/home/runner/.cache/pre-commit/repoqi7m9v0g/py_env-python3/lib/python3.10/site-packages/pre_commit_hook_ensure_sops/__main__.py", line 97, in <module>
    sys.exit(main())
  File "/home/runner/.cache/pre-commit/repoqi7m9v0g/py_env-python3/lib/python3.10/site-packages/pre_commit_hook_ensure_sops/__main__.py", line [85](https://github.com/FindHotel/cloud-platform-modules/actions/runs/6195858319/job/16821365826#step:5:89), in main
    is_valid, message = check_file(f)
  File "/home/runner/.cache/pre-commit/repoqi7m9v0g/py_env-python3/lib/python3.10/site-packages/pre_commit_hook_ensure_sops/__main__.py", line 53, in check_file
    doc = loader_func(f)
  File "/usr/lib/python3.10/json/__init__.py", line 293, in load
    return loads(fp.read(),
  File "/usr/lib/python3.10/json/__init__.py", line 346, in loads
    return _default_decoder.decode(s)
  File "/usr/lib/python3.10/json/decoder.py", line 337, in decode
    obj, end = self.raw_decode(s, idx=_w(s, 0).end())
  File "/usr/lib/python3.10/json/decoder.py", line 355, in raw_decode
    raise JSONDecodeError("Expecting value", s, err.value) from None
json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)
Traceback (most recent call last):
  File "/usr/lib/python3.10/runpy.py", line 196, in _run_module_as_main
    return _run_code(code, main_globals, None,
  File "/usr/lib/python3.10/runpy.py", line 86, in _run_code
    exec(code, run_globals)
  File "/home/runner/.cache/pre-commit/repoqi7m9v0g/py_env-python3/lib/python3.10/site-packages/pre_commit_hook_ensure_sops/__main__.py", line 97, in <module>
    sys.exit(main())
  File "/home/runner/.cache/pre-commit/repoqi7m9v0g/py_env-python3/lib/python3.10/site-packages/pre_commit_hook_ensure_sops/__main__.py", line 85, in main
    is_valid, message = check_file(f)
  File "/home/runner/.cache/pre-commit/repoqi7m9v0g/py_env-python3/lib/python3.10/site-packages/pre_commit_hook_ensure_sops/__main__.py", line 53, in check_file
    doc = loader_func(f)
  File "/usr/lib/python3.10/json/__init__.py", line 293, in load
    return loads(fp.read(),
  File "/usr/lib/python3.10/json/__init__.py", line 346, in loads
    return _default_decoder.decode(s)
  File "/usr/lib/python3.10/json/decoder.py", line 337, in decode
    obj, end = self.raw_decode(s, idx=_w(s, 0).end())
  File "/usr/lib/python3.10/json/decoder.py", line 355, in raw_decode
    raise JSONDecodeError("Expecting value", s, err.value) from None
json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)
yuvipanda commented 1 year ago

Do you have a view of the file this error is failing with? Or even the name of the file? It looks like we're trying to read as json something that isn't json

rlinstorres commented 1 year ago

Do you have a view of the file this error is failing with? Or even the name of the file? It looks like we're trying to read as json something that isn't json

Hi @yuvipanda, that's strange because we are not using json files, this is our local setting in terragrunt:

secrets = yamldecode(sops_decrypt_file(find_in_parent_folders("secret.yaml")))

I'm trying to figure out what is happening by doing some tests.

nialov commented 10 months ago

A minimal example of the file in question is required to debug this I believe! I can also debug the issue if it is provided.