.gitattributes

*.yml.enc diff=encrypted

.gitconfig

[diff "encrypted"]
        textconv = ~/bin/decrypt_creds

decrypt_creds

#! /usr/bin/env ruby

require 'active_support'
require 'active_support/encrypted_configuration'
require 'active_support/core_ext/hash/indifferent_access'

# get path from first paramater
credentials_path = ARGV[0]

match_data = credentials_path.match(%r{(\w+)\.yml\.enc})
if match_data
  env = match_data[1]
end

key_path = "#{Dir.pwd}/config/credentials/#{env}.key"

unless File.exist?(credentials_path) && File.exist?(key_path)
  puts "Credentials or key file not found."
  exit
end

encrypted_config = ActiveSupport::EncryptedConfiguration.new(
  config_path: credentials_path,
  key_path: key_path,
  env_key: "RAILS_MASTER_KEY",
  raise_if_missing_key: true
)

puts encrypted_config.read