A git pre-commit hook is probably the most common approach. Something like:

#!/bin/sh
# .git/hooks/pre-commit
for f in $(git diff --cached --name-only --diff-filter=ACM -- '.config/*.yaml'); do
  sops -e -i "$f"
  git add "$f"
done

Then decrypt after commit:

#!/bin/sh
# .git/hooks/post-commit
for f in $(git diff --name-only HEAD~1 -- '.config/*.yaml'); do
  sops -d -i "$f"
done

The annoying part is that programs reading the config need the decrypted version. A cleaner setup might be to keep the repo files always encrypted and use a wrapper script or sops exec-file to decrypt on the fly:

sops exec-file myconfig.yaml 'myapp --config {}'

Or you could look into git-crypt which handles the encrypt-on-commit / decrypt-on-checkout transparently via git filters, though it uses GPG rather than age/AWS KMS. If you're already invested in sops+age, the pre-commit hook route is probably the way to go.