SOPS AGE Decrypt Action

This action decrypts SOPS-encrypted files using an AGE private key provided via environment variable.

Environment

• AGE_PRIVATE_KEY: required. The AGE private key string. Exported internally as SOPS_AGE_KEY for sops.

Inputs

• encrypted_path: Path to a single encrypted file (relative to the working directory or absolute).
• decrypted_path: Path to write the decrypted file (created/overwritten). Required when encrypted_path is set.
• files: Multi-line list of encrypted:decrypted path pairs, one per line. Blank lines and lines starting with # are ignored.
• input_type: SOPS --input-type value (json, yaml, dotenv, binary). Omit for auto-detect.
• output_type: SOPS --output-type value (json, yaml, dotenv, binary). Omit for auto-detect.
• working_directory: optional. Directory to cd into before running decryption.

At least one of encrypted_path/decrypted_path or files must be provided. Both can be used together.

.sops.yml (or .sops.yaml) should exist in your repository to guide SOPS encryption. For decryption, SOPS reads key metadata from the encrypted file directly.

Example: single file

  - name: Decrypt secrets
    uses: r26d/sops-action@v1
    env:
      AGE_PRIVATE_KEY: ${{ secrets.AGE_PRIVATE_KEY }}
    with:
      working_directory: .
      encrypted_path: secrets.enc.yaml
      decrypted_path: secrets.yaml

Example: multiple files

  - name: Decrypt vault
    uses: r26d/sops-action@v1
    env:
      AGE_PRIVATE_KEY: ${{ secrets.SOPS_AGE_KEY }}
    with:
      working_directory: .vault
      files: |
        .env.signing.ci.enc:.env.signing
        apple/certs/developer_id/W78G6V5S6B.p12.enc:apple/certs/developer_id/W78G6V5S6B.p12
        apple/api_key.p8.enc:apple/api_key.p8

Example: binary output (P12 certs, GPG keys, etc.)

When encrypted files are SOPS JSON envelopes containing binary payloads, use input_type and output_type to control format handling:

  - name: Decrypt certificate
    uses: r26d/sops-action@v1
    env:
      AGE_PRIVATE_KEY: ${{ secrets.AGE_PRIVATE_KEY }}
    with:
      encrypted_path: cert.p12.enc
      decrypted_path: cert.p12
      input_type: json
      output_type: binary

Format flags apply to all files when combined with the files input — useful when a vault uses a single envelope format.