Merge pull request #29705 from y-yagi/do_not_update_secrets_yml_enc

Do not update `secrets.yml.enc` when secretes do not change

2 files changed, 21 insertions, 1 deletions

diff --git a/railties/lib/rails/secrets.rb b/railties/lib/rails/secrets.rb
index c7a8676d7b..955ab096e8 100644
--- a/railties/lib/rails/secrets.rb
+++ b/railties/lib/rails/secrets.rb
@@ -105,7 +105,9 @@ module Rails
 
           yield tmp_path
 
-          write(File.read(tmp_path))
+          updated_contents = File.read(tmp_path)
+
+          write(updated_contents) if updated_contents != contents
         ensure
           FileUtils.rm(tmp_path) if File.exist?(tmp_path)
         end
diff --git a/railties/test/secrets_test.rb b/railties/test/secrets_test.rb
index 36c8ef1fd9..321b654ae3 100644
--- a/railties/test/secrets_test.rb
+++ b/railties/test/secrets_test.rb
@@ -111,6 +111,24 @@ class Rails::SecretsTest < ActiveSupport::TestCase
     end
   end
 
+  test "do not update secrets.yml.enc when secretes do not change" do
+    run_secrets_generator do
+      Dir.chdir(app_path) do
+        Rails::Secrets.read_for_editing do |tmp_path|
+          File.write(tmp_path, "Empty streets, empty nights. The Downtown Lights.")
+        end
+
+        FileUtils.cp("config/secrets.yml.enc", "config/secrets.yml.enc.bk")
+
+        Rails::Secrets.read_for_editing do |tmp_path|
+          File.write(tmp_path, "Empty streets, empty nights. The Downtown Lights.")
+        end
+
+        assert_equal File.read("config/secrets.yml.enc.bk"), File.read("config/secrets.yml.enc")
+      end
+    end
+  end
+
   private
     def run_secrets_generator
       Dir.chdir(app_path) do