hash-sops.sh

# Assume 'secrets.yaml' is the file containing sensitive content
PRE_CHANGE_HASH=$(sha256sum secrets.yaml | awk '{print $1}')

# Performing operations that might change secrets.yaml

POST_CHANGE_HASH=$(sha256sum secrets.yaml | awk '{print $1}')

if [ "$PRE_CHANGE_HASH" != "$POST_CHANGE_HASH" ]; then
    sops --encrypt --age $(cat age.pub) secrets.yaml > secrets.enc.yaml
    echo "Encrypted secrets as contents have changed."
else
    echo "No change in secrets detected, skipping encryption."
fi