unpack

monkeys unpack <name> [directory] [--keep]

Reads a bundle, stores its secrets in your vault under each profile, writes the profiles and keys as a .monkeys file, and deletes the bundle:

monkeys unpack a

Passphrase:
wrote .monkeys: +foo @test,production @production, 3 keys
stored foo.test/DATABASE_URL, foo.production/DATABASE_URL, foo.test/STRIPE_SECRET_KEY, foo.production/STRIPE_SECRET_KEY
stored foo.production/SENTRY_DSN
removed a.monsecrets

<name> is the bundle, with or without its .monsecrets suffix; a path works too. The bundle is deleted only once every secret is stored and the file is written, since by then it has done its job and a copy left behind is one more thing to lose. --keep leaves it where it was, for a bundle you are handing on to someone else.

The file goes at the root of the git checkout, the way .gitignore sits at the root, so monkeys run works from any directory in it. Outside a checkout it goes in the current directory, and a second argument names the directory outright. When a .monkeys file is already there, unpack adds a block at the end for the keys the file does not yet list, grouped the way the bundle groups them, and leaves the rest of the file alone. A file that names another project on its + line refuses the bundle, and the bundle stays.

The passphrase is read from standard input when it is not a terminal.