fix(decrypt): ensure decrypted file ends with newline to prevent last multiline value truncation

scripts/commands/decrypt.sh

@@ -18,7 +18,6 @@ Typical usage:
   # Decrypt file inline
 
   $ helm secrets decrypt -i secrets/project/secrets.yaml
-
 EOF
 }
 
@@ -43,10 +42,20 @@ decrypt_helper() {
         if [ "${output}" = "" ] && [ "${output}" != "stdout" ]; then
             rm -rf "$(_file_dec_name "${encrypted_file_path}")"
         fi
-
         fatal 'Error while decrypting file: %s' "${encrypted_file_path}"
     fi
 
+    # Ensure the decrypted file ends with a newline. Some backends (e.g. sops)
+    # may omit the trailing newline after the last block-scalar value when the
+    # sops: metadata block is stripped during --output file mode, causing YAML
+    # parsers to produce values that differ from the stdout (secrets://) path.
+    # 'tail -c1 | wc -l' returns 0 when the last byte is not a newline.
+    if [ -n "${encrypted_file_dec}" ] && [ -f "${encrypted_file_dec}" ]; then
+        if [ "$(tail -c1 "${encrypted_file_dec}" | wc -l)" -eq 0 ]; then
+            printf '\n' >>"${encrypted_file_dec}"
+        fi
+    fi
+
     return 0
 }
 
@@ -61,7 +70,6 @@ decrypt() {
 
     argc=$#
     j=0
-
     while [ $j -lt $argc ]; do
         case "$1" in
         -i)
@@ -74,7 +82,6 @@ decrypt() {
             set -- "$@" "$1"
             ;;
         esac
-
         shift
         j=$((j + 1))
     done

scripts/lib/common.sh

@@ -134,6 +134,17 @@ Darwin)
             fi
         }
 
+        # On WSL1, sed -i fails on DrvFs mounts (/mnt/c/...) because the
+        # underlying VFS does not support atomic rename(2). Override _sed_i
+        # to use a temp-file + cp approach that avoids the in-place rewrite.
+        # Use mktemp with ${TMPDIR:-/tmp} so this is safe under set -u when
+        # TMPDIR is not exported (as on the GitHub Actions WSL runner).
+        _sed_i() {
+            _si_tmp=$(mktemp "${TMPDIR:-/tmp}/helm-secrets-XXXXXX")
+            sed "$1" "$2" >"$_si_tmp" && cp "$_si_tmp" "$2"
+            rm -f "$_si_tmp"
+        }
+
         # We are on a Linux VM, but helm.exe (Win32) is called
         case "${HELM_BIN}" in
         *.exe)

tests/unit/decrypt.bats

@@ -63,6 +63,65 @@ load '../bats/extensions/bats-file/load'
     assert_file_contains "${VALUES_PATH}" 'global_secret: global_bar'
 }
 
+@test "decrypt: Decrypt inline secrets.trailing-newline.raw (appends missing newline)" {
+    if ! is_backend "sops"; then
+        skip
+    fi
+
+    VALUES="assets/values/${HELM_SECRETS_BACKEND}/secrets.trailing-newline.raw"
+    VALUES_PATH="${TEST_TEMP_DIR}/${VALUES}"
+
+    run "${HELM_BIN}" secrets decrypt -i "${VALUES_PATH}"
+    assert_success
+
+    # The inline-decrypted file must end with a newline (exercises the printf '\n' branch)
+    run sh -c "tail -c1 '${VALUES_PATH}' | wc -l | tr -d ' '"
+    assert_output "1"
+}
+@test "decrypt: inline decrypt appends trailing newline when backend omits it" {
+    # Regression test for https://github.com/jkroepke/helm-secrets/issues/714
+    # Uses a mock backend that writes decrypted content WITHOUT a trailing newline,
+    # reproducing what sops --output does for block-scalar YAML in affected versions.
+    # This test FAILS without the printf '\n' fix in decrypt_helper (decrypt.sh).
+
+    local mock_backend="${TEST_TEMP_DIR}/no-newline-backend.sh"
+    local mock_file="${TEST_TEMP_DIR}/mock-secret.yaml"
+
+    # Encrypted file: content matches _BACKEND_REGEX so is_file_encrypted returns true.
+    printf 'secret_key: HELM_SECRETS_MOCK_TOKEN\n' >"${mock_file}"
+
+    # Write the mock backend. It sources _custom.sh (so _custom_backend_is_file_encrypted
+    # uses _BACKEND_REGEX correctly) then overrides _custom_backend_decrypt_file to write
+    # output WITHOUT a trailing newline — simulating the sops --output stripping bug.
+    cat >"${mock_backend}" <<'MOCKEOF'
+#!/usr/bin/env sh
+_BACKEND_REGEX='HELM_SECRETS_MOCK_TOKEN'
+# shellcheck source=scripts/lib/backends/_custom.sh
+. "${HELM_SECRETS_SCRIPT_DIR}/lib/backends/_custom.sh"
+# Override: write WITHOUT trailing newline to reproduce the sops stripping bug.
+_custom_backend_decrypt_file() {
+    # type=$1  input=$2  output=$3 (empty = stdout)
+    if [ -n "${3}" ]; then
+        printf 'secret_key: decrypted_value' >"${3}"
+    else
+        printf 'secret_key: decrypted_value'
+    fi
+}
+MOCKEOF
+    chmod +x "${mock_backend}"
+
+    # Use --backend flag so load_secret_backend sets HELM_SECRETS_SCRIPT_DIR before sourcing.
+    run "${HELM_BIN}" secrets --backend "${mock_backend}" decrypt -i "${mock_file}"
+    assert_success
+
+    # The fix in decrypt_helper must have appended a newline after the backend wrote without one.
+    # Without the fix in decrypt.sh, tail -c1 | wc -l returns 0 and the test FAILS.
+    run sh -c "tail -c1 '${mock_file}' | wc -l | tr -d ' '"
+    assert_output "1"
+
+    assert_file_contains "${mock_file}" "secret_key: decrypted_value"
+}
+
 @test "decrypt: Decrypt secrets.yaml.gotpl" {
     if ! is_backend "sops"; then
         skip