- path_regex of .sops.yaml uses wrong input

[toralf]

SUMMARY

It checks the value of the current working directory instead the path of the file

ISSUE TYPE

• Bug Report

COMPONENT NAME

community.sops.sops_encrypt

ANSIBLE VERSION

$ ansible --version
ansible [core 2.12.5]
config file = None
configured module search path = ['/home/tfoerste/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
ansible python module location = /usr/lib/python3.9/site-packages/ansible
ansible collection location = /home/tfoerste/.ansible/collections:/usr/share/ansible/collections
executable location = /usr/lib/python-exec/python3.9/ansible
python version = 3.9.12 (main, Apr 29 2022, 22:11:52) [GCC 11.2.1 20220115]
jinja version = 3.1.2
libyaml = True

OS / ENVIRONMENT

LInux (Gentoo), Mac

[toralf]

If works as designed then "chdir" should be implemented as a new feature.

[felixfontein]

If the provided path is not just a filename but contains a path, the module will change into that directory before executing sops.

(Please note that sops does not know the filename, since the data is piped into and out from sops, and only written to disk by the module once sops returns.)

[toralf]

Hhm, the paths contains the whole paths to the file, but it seems we do suffer from getsops/sops#594

$  echo "key: value"  | sops --encrypt /dev/stdin --config .sops.yaml --output foo.yaml
error loading config: no matching creation rules found

whereas this works:

$  echo "key: value" > devinfra/database/foo.yaml; sops --encrypt devinfra/database/foo.yaml --config .sops.yaml --output devinfra/database/bar.yaml
key: ENC[AES256_GCM,data:<snip>=,tag:<snip>==,type:str]
sops:
    kms:
        - arn: arn:aws:kms:eu-central-1<snip>:alias/mozilla-sops

[ghost]

ok, so it seems, that path_regex cannot be used in .sops.yaml, b/c it is just /dev/stdin.