GitHub Action overview
rafay99-epic/envpilot-action@v1 pulls your project's variables into a workflow job, masks every value in the log, and optionally materialises secret files on the runner.
Create a key#
Mint it#
In Envpilot, go to Organization → Settings → API Keys and create a key with the GitHub Action surface, scoped to the project and environment(s) the workflow needs. Add the files resource only if the workflow pulls secret files — it is never granted by default.
Store it#
Copy the envpk_… value — it is shown once — and save it as a repository secret, e.g. ENVPILOT_TOKEN.
Use it#
Reference it as ${{ secrets.ENVPILOT_TOKEN }} in the workflow.
Usage#
jobs:
deploy:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Pull environment variables
uses: rafay99-epic/envpilot-action@v1
with:
token: ${{ secrets.ENVPILOT_TOKEN }}
environment: production
- name: Deploy
run: ./deploy.sh # DATABASE_URL, API_SECRET, … are already in the environmentBy default (export-env: "true") every pulled variable is appended to $GITHUB_ENV, so it becomes a normal environment variable for every later step in the job. No extra wiring.
To write a dotenv file instead of, or alongside, exporting:
- uses: rafay99-epic/envpilot-action@v1
with:
token: ${{ secrets.ENVPILOT_TOKEN }}
environment: production
export-env: "false"
env-file: .envThe dotenv file is written with mode 0600.
Versioning#
@v1 is a floating major tag: it always points at the newest 1.x release, which is how you get non-breaking updates without editing every workflow. Pin @vX.Y.Z instead if you need a frozen build.
Limits#
- Read-only. The key pulls variables and files. It can never create, edit, delete, or file a request — CI reads, it does not negotiate.
public_apitier gate. Machine access is a Pro feature.- One environment per step. Pull twice for two environments.
projectis required for files. The files endpoint is project-scoped even when the token's scope resolves a single project.- Rate limited per key. See Rate limits.
- Runs on
node24(Node LTS). Needs Actions runner v2.327.1 or newer — GitHub-hosted runners always are; self-hosted runners pinned below that must update.