unpack

monkeys unpack <name> [directory] [--keep]

Reads a bundle, remembers its secrets in your vault under each profile, writes the profiles and keys as a .monkeys file, and deletes the bundle:

monkeys unpack a

passphrase:
wrote .monkeys: +foo @test,production @production, 3 keys
remembered foo.test/DATABASE_URL, foo.production/DATABASE_URL, foo.test/STRIPE_SECRET_KEY, foo.production/STRIPE_SECRET_KEY
remembered foo.production/SENTRY_DSN
removed a.monsecrets

<name> is the bundle, with or without its .monsecrets suffix; a path works too. The bundle is deleted only once every secret is remembered and the file is written. By then it has done its job, and a copy left behind is one more thing to lose. --keep leaves it where it was, for a bundle you are handing on to someone else, and the run says nothing about removing it:

monkeys unpack a --keep

passphrase:
wrote .monkeys: +foo @test,production @production, 3 keys
remembered foo.test/DATABASE_URL, foo.production/DATABASE_URL
remembered foo.production/SENTRY_DSN

The file goes at the root of the git checkout, the way .gitignore sits at the root, so monkeys run works from any directory in it. Outside a checkout it goes in the current directory, and a second argument names the directory outright. When a .monkeys file is already there, unpack leaves it alone except for one block at the end, carrying the keys the file does not yet list, grouped the way the bundle groups them. A file that names another project on its + line refuses the bundle, and the bundle stays.

A bundle that carries values writes them into .monkeys as KEY=value lines the same way, adding the ones the file does not have and leaving the ones it has:

wrote .monkeys: +foo @test, 2 keys
wrote .monkeys: 2 values
remembered foo.test/DATABASE_URL, foo.test/STRIPE_SECRET_KEY
removed /tmp/a.monsecrets

The passphrase is read from standard input when it is not a terminal.