base.sh now clones secrets repo