From 50d318641a7e137149d43e8c719318d6ab749b3e Mon Sep 17 00:00:00 2001
From: Rubin Bhandari <roobin.bhandari@gmail.com>
Date: Tue, 11 Nov 2025 01:57:40 +0545
Subject: [PATCH] feat(chezmoi): add `exclude_encrypted` config (#1453)

Co-authored-by: Gideon <87426140+GideonBear@users.noreply.github.com>
---
 config.example.toml  |  5 +++++
 src/config.rs        | 18 ++++++++++++++++++
 src/steps/generic.rs | 10 +++++++++-
 3 files changed, 32 insertions(+), 1 deletion(-)

diff --git a/config.example.toml b/config.example.toml
index c7131d85..3d5b8c4f 100644
--- a/config.example.toml
+++ b/config.example.toml
@@ -286,6 +286,11 @@
 # winget_use_sudo = true
 
 
+[chezmoi]
+# Exclude encrypted files from update
+# (default: false)
+# exclude_encrypted = false
+
 [npm]
 # Use sudo if the NPM directory isn't owned by the current user
 # use_sudo = true
diff --git a/src/config.rs b/src/config.rs
index ac9f9d9c..33c17d83 100644
--- a/src/config.rs
+++ b/src/config.rs
@@ -165,6 +165,13 @@ pub struct Deno {
     version: Option<String>,
 }
 
+#[derive(Deserialize, Default, Debug, Merge)]
+#[serde(deny_unknown_fields)]
+#[allow(clippy::upper_case_acronyms)]
+pub struct Chezmoi {
+    exclude_encrypted: Option<bool>,
+}
+
 #[derive(Deserialize, Default, Debug, Merge)]
 #[serde(deny_unknown_fields)]
 #[allow(clippy::upper_case_acronyms)]
@@ -457,6 +464,9 @@ pub struct ConfigFile {
     #[merge(strategy = crate::utils::merge_strategies::inner_merge_opt)]
     npm: Option<NPM>,
 
+    #[merge(strategy = crate::utils::merge_strategies::inner_merge_opt)]
+    chezmoi: Option<Chezmoi>,
+
     #[merge(strategy = crate::utils::merge_strategies::inner_merge_opt)]
     yarn: Option<Yarn>,
 
@@ -1774,6 +1784,14 @@ impl Config {
             .unwrap_or(false)
     }
 
+    pub fn chezmoi_exclude_encrypted(&self) -> bool {
+        self.config_file
+            .chezmoi
+            .as_ref()
+            .and_then(|chezmoi| chezmoi.exclude_encrypted)
+            .unwrap_or(false)
+    }
+
     pub fn vscode_profile(&self) -> Option<&str> {
         let vscode_cfg = self.config_file.vscode.as_ref()?;
         let profile = vscode_cfg.profile.as_ref()?;
diff --git a/src/steps/generic.rs b/src/steps/generic.rs
index 96016b60..a5ed114b 100644
--- a/src/steps/generic.rs
+++ b/src/steps/generic.rs
@@ -916,9 +916,17 @@ pub fn run_chezmoi_update(ctx: &ExecutionContext) -> Result<()> {
     let chezmoi = require("chezmoi")?;
     HOME_DIR.join(".local/share/chezmoi").require()?;
 
+    let mut cmd = ctx.execute(chezmoi);
+
     print_separator("chezmoi");
 
-    ctx.execute(chezmoi).arg("update").status_checked()
+    cmd.arg("update");
+
+    if ctx.config().chezmoi_exclude_encrypted() {
+        cmd.arg("--exclude=encrypted");
+    }
+
+    cmd.status_checked()
 }
 
 pub fn run_myrepos_update(ctx: &ExecutionContext) -> Result<()> {