try fixing templates on home-manager

.mergify.yml

@@ -1,14 +1,13 @@
 queue_rules:
   - name: default
-    queue_conditions:
-      - base=master
-      - label~=merge-queue|dependencies
     merge_conditions:
       - check-success=buildbot/nix-build
     merge_method: rebase
 
 pull_request_rules:
   - name: refactored queue action rule
-    conditions: []
+    conditions:
+      - base=master
+      - label~=merge-queue|dependencies
     actions:
       queue:

checks/darwin.nix

@@ -1,10 +1,16 @@
-
+{
+  config,
+  ...
+}:
 {
   imports = [
     ../modules/nix-darwin/default.nix
   ];
   documentation.enable = false;
   sops.secrets.test_key = { };
+  sops.templates."template.toml".content = ''
+    password = "${config.sops.placeholder.test_key}";
+  '';
   sops.defaultSopsFile = ../pkgs/sops-install-secrets/test-assets/secrets.yaml;
   sops.age.generateKey = true;
   system.stateVersion = 5;

checks/home-manager.nix

@@ -1,5 +1,5 @@
-
-{ config, ... }: {
+{ config, ... }:
+{
   imports = [
     ../modules/home-manager/sops.nix
   ];
@@ -11,5 +11,8 @@
   sops.age.generateKey = true;
   sops.age.keyFile = "${config.home.homeDirectory}/.age-key.txt";
   sops.secrets.test_key = { };
+  sops.templates."template.toml".content = ''
+    password = "${config.sops.placeholder.test_key}";
+  '';
   sops.defaultSopsFile = ../pkgs/sops-install-secrets/test-assets/secrets.yaml;
 }

modules/home-manager/sops.nix

@@ -99,6 +99,7 @@ let
         sshKeyPaths = cfg.gnupg.sshKeyPaths;
         ageKeyFile = cfg.age.keyFile;
         ageSshKeyPaths = cfg.age.sshKeyPaths;
+        placeholderBySecretName = cfg.placeholder;
         userMode = true;
         logging = {
           keyImport = builtins.elem "keyImport" cfg.log;

modules/home-manager/templates.nix

@@ -12,6 +12,8 @@ let
     mapAttrs
     types
     ;
+
+  hmConfig = config;
 in
 {
   options.sops = {
@@ -33,7 +35,7 @@ in
                 description = "Path where the rendered file will be placed";
                 type = types.singleLineStr;
                 # Keep this in sync with `RenderedSubdir` in `pkgs/sops-install-secrets/main.go`
-                default = "${config.xdg.configHome}/sops-nix/secrets/rendered/${config.name}";
+                default = "${hmConfig.xdg.configHome}/sops-nix/secrets/rendered/${config.name}";
               };
               content = mkOption {
                 type = types.lines;
@@ -97,10 +99,10 @@ in
   };
 
   config = lib.optionalAttrs (options ? sops.secrets) (
-    lib.mkIf (config.sops.templates != { }) {
+    lib.mkIf (hmConfig.sops.templates != { }) {
       sops.placeholder = mapAttrs (
         name: _: mkDefault "<SOPS:${builtins.hashString "sha256" name}:PLACEHOLDER>"
-      ) config.sops.secrets;
+      ) hmConfig.sops.secrets;
     }
   );
 }

pkgs/sops-install-secrets/main.go

@@ -698,7 +698,11 @@ func (app *appContext) validateManifest() error {
 		// The Nix module only defines placeholders for secrets if there are
 		// templates.
 		if len(m.Templates) > 0 {
-			placeholder := m.PlaceholderBySecretName[secret.Name]
+			placeholder, present := m.PlaceholderBySecretName[secret.Name]
+			if !present {
+				return fmt.Errorf("placeholder for %s not found in manifest", secret.Name)
+			}
+
 			app.secretByPlaceholder[placeholder] = secret
 		}
 	}