[sops] Allow encode=base64 config for sops provider

[seuf]

When referencing a sops secret, allow vals tu return it as a base64 encoded string

data:
  config.env: ref+sops://config/config.enc.env?encode=base64

the results is a base64 encoded string of the decrypted config/config.enc.env file.

It's like issue #163 but for sops provider.

[Copilot]

Pull request overview

Adds support to the sops provider for returning decrypted secret contents as a base64-encoded string via ?encode=base64, matching behavior already present in the file provider and addressing the use case described in issue #163.

Changes:

• Introduce an encode configuration option for the sops provider (default: raw).
• Update GetString to optionally base64-encode decrypted bytes when encode=base64.
• Add unit tests verifying New reads the encode config and defaults it appropriately.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
pkg/providers/sops/sops.go	Adds Encode config and applies it in GetString to return raw or base64 output.
pkg/providers/sops/sops_test.go	Adds tests for default and configured Encode value in provider construction.

[Copilot]

New encode behavior in GetString isn’t covered by unit tests (no tests call GetString in this package). Please add a test that exercises encode=base64 (verifies output matches base64.StdEncoding.EncodeToString of decrypted bytes) and the unsupported encode error path; this may require making decrypt stub-able (e.g., via an injectable function field) or adding a small helper that can be tested directly.

[Copilot]

These tests validate that New reads encode, but they don’t validate the externally observable behavior (that GetString returns base64 when encode=base64). Consider extending coverage to assert the actual returned value/error for each encode mode, so regressions in GetString aren’t missed.