Init a8c-secrets (identities only)

[mokagio]

See AINFRA-2776, under AINFRA-1541.

I was looking at #4731 to get it ready for a new round of review and grew overwhelmed by the various changes and the open question of how it should flow in CI vs local (when and how to call the decrypt?) and for internal vs external contributors.

As such, I've decided to extract the parts that are already good in dedicated PRs, and to rework the remainder in isolation.

This PR sets up the a8c-secrets identities and .gitattributes. I may have gone a bit overboard with extracting this, too. But, I thought it'd be interesting to see how GitHub would render the upcoming .age files in the diff once this lands with the instruction to treat them as binaries.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[claude]

Claude finished @mokagio's task in 46s —— View job

---

PR Review: Init a8c-secrets (identities only)

• Read PR diff and changed files
• Review for correctness, security & best practices
• Post review

---

This is a clean, well-scoped tooling PR. I reviewed all 3 files. Summary: looks good to merge, with a couple of minor observations (nothing blocking).

🔒 Security — no secrets exposed ✅

The most important thing to verify here, and it checks out:

• .a8c-secrets/keys.pub contains age1… recipient (public) keys, not private ones. Private keys have the AGE-SECRET-KEY-1… prefix, which is absent. These are meant to be committed — they're the public half used to encrypt secrets.
• .a8c-secrets/repo-id (pocket-casts-ios@github.com@automattic) is just an identifier, not sensitive.

So nothing secret is landing in git history. 👍

.gitattributes — binary behavior is correct

.a8c-secrets/**/*.age binary

• The **/ glob matches zero-or-more path segments, so this correctly covers both .a8c-secrets/foo.age and nested .a8c-secrets/sub/foo.age. No gap there.
• binary expands to -text -diff -merge, which means GitHub will render future .age files as binary and won't show a textual diff. Worth flagging against your stated curiosity in the description ("see how GitHub would render the upcoming .age files in the diff") — with this attribute you'll get "Binary file not shown" rather than line-by-line content. That's the right call for encrypted blobs (avoids noisy/meaningless diffs and bogus merge attempts), just noting the two goals are slightly in tension. If you ever switch to age's ASCII-armored output and want to eyeball diffs, you'd drop binary and use -merge instead.

Minor / optional nits

• Trailing newline on repo-id: the diff shows a single line (+1 with no newline marker). Most tooling tolerates this, but a trailing newline is the POSIX-friendly convention and keeps future git diff output from showing a \ No newline at end of file marker. Only worth it if the consuming script is picky.
• Comments in keys.pub: nice touch labeling # dev / # ci. Just confirm the downstream a8c-secrets tooling ignores # comment lines when parsing recipients (the standard tooling does), otherwise they'd be treated as invalid recipients.

Nice job keeping this extraction small and reviewable — much easier to reason about than #4731. 🎉
• ainfra-2776-a8c-secrets-prep-in-pocket-casts-ios-add-identities-only

[claude]

Claude finished @mokagio's task in 42s —— View job

---

PR Review: Init a8c-secrets (identities only)

• Read PR diff and changed files
• Review for correctness, security & best practices
• Post review

---

Re-reviewed after the latest push (6fa3c69 — restricting the .age glob to first-level children). This is a clean, well-scoped tooling PR and it looks good to merge.

🔒 Security — no secrets exposed ✅

The critical check passes:

• .a8c-secrets/keys.pub holds only age1… recipient (public) keys — no AGE-SECRET-KEY-1… private keys. These are the public halves used to encrypt and are meant to be committed.
• .a8c-secrets/repo-id (pocket-casts-ios@github.com@automattic) is just an identifier, not sensitive.

Nothing secret lands in git history. 👍

.gitattributes — glob change is correct

.a8c-secrets/*.age binary

Good call adopting @AliSoftware's suggestion. Since a8c-secrets enforces a flat file structure per repo (no nested dirs, to guard against ..//symlink tricks), a single-segment *.age glob fully covers every .age file that can exist here — the earlier **/*.age matched paths that will never be created. binary (= -text -diff -merge) is the right treatment for encrypted blobs: GitHub renders them as "Binary file not shown" and skips bogus merge attempts.

Minor / optional nits (non-blocking)

• No trailing newline on repo-id — cat -A confirms the file ends with ...@automattic and no newline. Harmless for most parsers, but a trailing newline is the POSIX-friendly convention and avoids a \ No newline at end of file marker in future diffs. Only worth changing if the consuming tooling is picky.
• # comment lines in keys.pub — the # dev / # ci labels are a nice touch; just worth confirming the a8c-secrets recipient parser ignores # lines (the standard tooling does) so they aren't treated as invalid recipients.

Nice job keeping this extraction small and reviewable. 🎉
• Branch: ainfra-2776-a8c-secrets-prep-in-pocket-casts-ios-add-identities-only