Skip to content
Hush

Monorepo Patterns

Hush v3 stores monorepo authority in encrypted repository documents instead of a plaintext routing file.

Current monorepo model

.hush/manifest.encrypted
.hush/files/**.encrypted

In a monorepo, the manifest records:

  • identities
  • bundles
  • targets
  • imports
  • file index metadata

The encrypted files hold the secret entries and readers that back those targets.

Typical repository shape

  • Directoryapps/
    • Directoryweb/
      • …
    • Directoryapi/
      • …
  • Directorypackages/
    • Directoryshared/
      • …
  • Directory.hush/
    • manifest.encrypted
    • Directoryfiles/
      • Directoryenv/
        • Directoryproject/
          • shared.encrypted
  • .sops.yaml

1. Bootstrap once

Terminal window
hush bootstrap

2. Inspect the current repo state

Terminal window
hush config show
hush config show files
hush config active-identity

3. Add shared secrets

Terminal window
hush set DATABASE_URL
hush set STRIPE_SECRET_KEY

4. Run a specific target

Terminal window
hush run -t api -- wrangler dev
hush run -t runtime -- npm run dev

How to think about targets in v3

Targets are now part of the encrypted repository manifest. Use hush config to inspect them and the file documents they depend on.

That means the current guidance for monorepos is:

  • bootstrap the .hush/ repo
  • inspect targets and files with hush config
  • keep shared authority in encrypted file documents
  • run commands through hush run

Example review loop

Terminal window
hush config show
hush config show files
hush inspect
hush run -- npm run dev

Legacy repositories

If a monorepo still uses legacy include/exclude target rules in hush.yaml, treat that as migration-only state.

Terminal window
hush migrate --from v2
hush migrate --from v2 --cleanup