[13.x] Add incremental readable env encryption

[mathiasgrimm]

This adds --incremental to env:encrypt --readable so changing one value does not change every encrypted line in the PR diff.

Docs: laravel/docs#11357.

Unchanged values keep their ciphertext. New or changed values are encrypted, and deleted variables are removed. The option creates the encrypted file if it is missing and does not require --force.

If the existing file is not readable or cannot be decrypted, the command fails without overwriting it. Regular --force still re-encrypts everything.

Before / after

For example, changing only DB_PASSWORD=1 to DB_PASSWORD=2 produces these diffs in the encrypted file. Ciphertext is shown as placeholders for readability.

Before, with --readable --force, every encrypted entry changes:

-APP_NAME=<previous app name ciphertext>
-DB_HOST=<previous host ciphertext>
-DB_PASSWORD=<previous password ciphertext>
+APP_NAME=<new app name ciphertext>
+DB_HOST=<new host ciphertext>
+DB_PASSWORD=<new password ciphertext>

After, with --readable --incremental, only the password entry changes:

 APP_NAME=<unchanged app name ciphertext>
 DB_HOST=<unchanged host ciphertext>
-DB_PASSWORD=<previous password ciphertext>
+DB_PASSWORD=<new password ciphertext>

Try it locally

Use a disposable Laravel app running this branch. All values below are for testing. REVIEW_KEY is a dummy 32-byte key for testing only.

Create .env.review:

APP_NAME=ReviewDemo
DB_HOST=localhost
DB_PASSWORD=1

Create the encrypted baseline:

export REVIEW_KEY=abc123abc123abc123abc123abc123ab

php artisan env:encrypt --env=review --readable --incremental --key="$REVIEW_KEY"

cp .env.review .env.review.baseline
cp .env.review.encrypted .env.review.encrypted.baseline

Each encryption command below should print:

INFO  Environment successfully encrypted.

Other command output is omitted. Ciphertext in the example diffs is shortened for readability.

No changes

php artisan env:encrypt --env=review --readable --incremental --key="$REVIEW_KEY"

diff -u .env.review.encrypted.baseline .env.review.encrypted

No diff is produced.

Change only DB_PASSWORD

Change DB_PASSWORD=1 to DB_PASSWORD=2 in .env.review, then run:

php artisan env:encrypt --env=review --readable --incremental --key="$REVIEW_KEY"

diff -u .env.review.encrypted.baseline .env.review.encrypted

Only the password entry changes:

 APP_NAME=<unchanged ciphertext>
 DB_HOST=<unchanged ciphertext>
-DB_PASSWORD=<previous ciphertext>
+DB_PASSWORD=<new ciphertext>

Delete DB_PASSWORD

Restore the baseline first:

cp .env.review.baseline .env.review
cp .env.review.encrypted.baseline .env.review.encrypted

Remove the DB_PASSWORD line from .env.review, then run:

php artisan env:encrypt --env=review --readable --incremental --key="$REVIEW_KEY"

diff -u .env.review.encrypted.baseline .env.review.encrypted

Only that entry is removed:

 APP_NAME=<unchanged ciphertext>
 DB_HOST=<unchanged ciphertext>
-DB_PASSWORD=<previous ciphertext>

diff returns exit code 1 when it finds differences; that is expected for the last two examples.

[github-actions]

Thanks for submitting a PR!

Note that draft PRs are not reviewed. If you would like a review, please mark your pull request as ready for review in the GitHub user interface.

Pull requests that are abandoned in draft may be closed due to inactivity.