[osteele]

I’ve started to use Jupyter notebooks, with devop recipes as different sections, for this.

You can keep the notebook in the repo if you do two (or three) things:

1. The scripts read passwords from a key store instead of the notebook source. I wrote a Python package for doing this easily in Python cells; for bash, I just use subcommands.

2. A git pre-commit hook clears the notebook output cells.

3. (Optional) A git pre-commit or pre-push hook searches for text that looks like private credentials.