❯envpilot
// docs

GitHub Action

Pull environment variables from Envpilot into a GitHub Actions job — no more copy-pasting secrets into repository settings.

open in claudeopen in chatgptopen in cursor

GitHub Action

envpilot-action pulls environment variables from Envpilot straight into a GitHub Actions job, so your deploy secrets live in one place instead of being duplicated into GitHub repository settings.

Create a key#

The Action authenticates with an API key (envpk_…), the same credential the REST API and MCP server use. Create one in Organization Settings → API Keys:

  1. Click New API Key and select the GitHub Action surface.
  2. Lock it to a single project and the variables resource — that's all CI needs.
  3. Copy the envpk_… value (shown once) and store it as a GitHub repository or environment secret (ENVPILOT_TOKEN in the examples below).

There is no separate "CI/CD service token" to mint — an Action key is just an API key with the GitHub Action surface. It is read-only and can never file a variable request; CI reads, it does not negotiate.

Usage#

❯yaml
- name: Pull environment variables
  uses: rafay99-epic/envpilot-action@v1
  with:
    token: ${{ secrets.ENVPILOT_TOKEN }}
    environment: production

Store the API key as a repository or environment secret (ENVPILOT_TOKEN above) — never hardcode it in the workflow file.

Inputs#

InputRequiredDefaultDescription
tokenYes—Envpilot API key (envpk_…) with the GitHub Action surface, locked to a single project
environmentYes—Environment to pull, e.g. production, staging, development
api-urlNohttps://www.envpilot.devEnvpilot API base URL. Override only for self-hosted or non-production instances
export-envNo"true"When true, exports every pulled variable to $GITHUB_ENV so later steps can read it directly
env-fileNo—Path to write the pulled variables as a dotenv file (KEY='value' per line). Skipped if unset

How variables reach later steps#

By default (export-env: "true"), the action appends every pulled variable to the special $GITHUB_ENV file that GitHub Actions exposes to each step. Anything written there becomes a regular environment variable for every subsequent step in the same job — no extra wiring needed:

❯yaml
jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
 
      - name: Pull environment variables
        uses: rafay99-epic/envpilot-action@v1
        with:
          token: ${{ secrets.ENVPILOT_TOKEN }}
          environment: production
 
      - name: Deploy
        run: ./deploy.sh # DATABASE_URL, API_SECRET, etc. are already in the environment

To write a dotenv file instead of (or in addition to) exporting:

❯yaml
- uses: rafay99-epic/envpilot-action@v1
  with:
    token: ${{ secrets.ENVPILOT_TOKEN }}
    environment: production
    export-env: "false"
    env-file: .env

Masking guarantee#

Every pulled value is registered with GitHub Actions' log masking (core.setSecret) before it is exported or written anywhere. That means the value is redacted as *** in the job log even if a later step accidentally echoes it — masking happens at the runner level, not as a best-effort convention.

Security#

  • Read-only. The key can pull variables; it cannot create, modify, or delete them — and it can never file a variable request. CI reads only.
  • Project-scoped. An Action key only reads the single project and environment(s) it was minted for — it can't be pointed at other projects, and the action never prints or logs the key itself.
  • Revocable with no grace period. Revoke a key from Envpilot under Organization Settings → API Keys — the next pull is rejected immediately.
  • Rate limited. Pulls are rate-limited per key; a workflow that hammers this action in a tight loop will start getting 429 responses. See Rate limits.
  • Ephemeral by design. GitHub-hosted runners are destroyed after the job finishes, so pulled values never persist beyond the job's lifetime unless you explicitly write them to an artifact.

See API Security for the full key model shared across the GitHub Action, REST API, and MCP server.