tangled_comments: read a pull's review comments; secrets: resolve sops off-PATH

secrets.py

@@ -46,12 +46,21 @@ STORE = os.environ.get("AO_SECRETS_STORE", "/secrets/store.yaml")
 AGE_KEY = os.environ.get("SOPS_AGE_KEY_FILE", os.path.expanduser("~/.config/sops/age/keys.txt"))
 
 
+def _sops_bin():
+    """Resolve sops. It is on PATH under the systemd unit, but not always in an
+    interactive shell — fall back to the NixOS system profile before failing."""
+    return (shutil.which("sops")
+            or next((p for p in ("/run/current-system/sw/bin/sops",
+                                 "/run/wrappers/bin/sops") if os.path.exists(p)), None)
+            or "sops")
+
+
 def _load():
     """Decrypt the store. Fails loudly: a silent empty dict would look like 'no secrets'."""
     if not pathlib.Path(STORE).exists():
         sys.exit(f"no secret store at {STORE} — see engine/README.md (Secrets)")
     env = {**os.environ, "SOPS_AGE_KEY_FILE": AGE_KEY}
-    r = subprocess.run(["sops", "-d", "--output-type", "json", STORE],
+    r = subprocess.run([_sops_bin(), "-d", "--output-type", "json", STORE],
                        capture_output=True, text=True, env=env)
     if r.returncode != 0:
         sys.exit(f"cannot decrypt {STORE} (age key at {AGE_KEY}?): {r.stderr.strip()[:300]}")