Nice way to have secrets in LastPass locally but in GitHub Secrets in CI?

[pedantic-git]

I've been trying for the last few hours to do a nice convention-over-configuration implementation of the following scenario:

1. When running kamal deploy in GitHub Actions, the secrets are pulled from the environment (as they are stored in GitHub Secrets)
2. When running it on my local machine, they're pulled from LastPass using kamal secrets.

I understand I could do this in a number of ways:

• Writing a script that returns the same format as kamal secrets fetch and then calling that from within .kamal/secrets
• Using .env instead of LastPass and running dotenv kamal deploy when running locally
• Some sort of monstrosity within .kamal/secrets that checks for the existence of the lpass command on every line

None of these feel very clean or convention-over-configuration to me. Does anyone have an alternative implementation?

Some wishlist changes to Kamal's behaviour that would be nice, if no standard nice way is availalbe:

• If Kamal just used the environment for all secrets if .kamal/secrets is absent - that way I can have my CI merely delete the .kamal/secrets file before running kamal deploy and everything would work.
• A way to select a different secrets file based on the presence of the CI environment variable, for example.
• Erb in the secrets file? Still quite ugly.

[pedantic-git]

My current workaround is to have a script bin/env-or-secrets.rb that I call instead of kamal in my secrets file. It actually works but it's pretty ugly:

#!/usr/bin/env ruby

# This is a crude attempt to work around https://github.com/basecamp/kamal/issues/1867
# If the lpass command doesn't exist, it pulls anything that looks like an env var
# off the end of ARGV and returns a hash that looks like it

require "json"
require "open3"
require "shellwords"

# https://stackoverflow.com/a/42533209
def command?(name) = [name, *ENV['PATH'].split(File::PATH_SEPARATOR).map {|p| File.join(p, name)}].find {|f| File.executable?(f)}

if command? "lpass"
  Open3.capture2("kamal", *ARGV).first
else
  ARGV.grep(/\A[A-Z_]+\Z/).to_h { [ it, ENV[it] ] }.to_json
end.then { puts Shellwords.escape it }

[djmb]

I'd like to add a mechanism to cut out the secrets files entirely and just specify the secret information directly in the deploy.yml files. Then we could use ERB in there to decide where to load the secrets from based on the location.