KO | EN

GitLite

Minimalist Open Source Repository Search Engine

gitlite — search

#dsh #dsh-plugin #developer-tools #ai-agent #claude-code #codex #typescript #ai-agents #deepseek-harness #mcp #cli #rust

actions

★ 48 Open GitHub ↗

Load secrets into GitHub Actions

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

<hr/>

 <img src="https://1password.com/img/logo-v1.svg" alt="1Password" width="20" /> SecretHub has joined 1Password! Find out more on the <a href="https://secrethub.io/blog/secrethub-joins-1password/">SecretHub blog</a>. 🎉

<hr/>

# Actions

[![](https://github.com/secrethub/actions/workflows/.github/workflows/main.yml/badge.svg)](https://github.com/secrethub/actions/actions)
[![](https://img.shields.io/github/release/secrethub/actions.svg)](https://github.com/secrethub/actions/releases/latest)
[![](https://img.shields.io/badge/chat-on%20discord-7289da.svg?logo=discord)](https://discord.gg/NWmxVeb)

> [SecretHub](https://secrethub.io) is a secrets management tool that works for every engineer. Securely provision passwords and keys throughout your entire stack with just a few lines of code.

No more copy-pasting sensitive values into a GUI. Securely load secrets into GitHub Actions and sync them automatically using SecretHub.

This Action is officially supported and actively maintained by SecretHub, but community contributions are very welcome.

## secrethub/actions/env-export

The `env-export` action reads all referenced secrets from environment variables prefixed by `secrethub://` and secrets specified in the `secrethub.env` template file, and makes the secret values available as environment variables to the rest of the job.

It leverages GitHub's output masking feature, so if secret values are (accidentally) logged, they get replaced with `*****`.

### Usage

```yml
on: push
jobs:
  notify-slack:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - uses: secrethub/actions/env-export@v0.2.1
        env:
          SECRETHUB_CREDENTIAL: ${{ secrets.SECRETHUB_CREDENTIAL }}
          SLACK_WEBHOOK: secrethub://company/app/slack/webhook
      - name: Print environment with masked secrets
        run: printenv
      - name: Notify Slack
        # This action expects SLACK_WEBHOOK to be set, which is now done automatically
        uses: Ilshidur/action-slack@2.0.1
        with:
          args: Sent from GitHub Actions with secrets from SecretHub 🔑
```

## Credential

The example above passes the `SECRETHUB_CREDENTIAL` environment variable. This credential is used to authenticate to SecretHub and decrypt your secrets.

You can obtain a credential by creating a [service account](https://secrethub.io/docs/reference/cli/service). Service accounts are completely separate accounts from your personal account, which means you can [manage their access](https://secrethub.io/docs/reference/cli/acl/) separately and you can identify them in the [audit log](https://secrethub.io/docs/reference/cli/audit/).

After you've obtained a credential for SecretHub, you [store it in a GitHub secret](https://help.github.com/en/actions/configuring-and-managing-workflows/creating-and-storing-encrypted-secrets#creating-encrypted-secrets-for-a-repository), so that it can be fetched in your action as shown above.

actions

Explore Similar Repositories

Was this content helpful?

Recent Feedback

Download README