Move from GitHub Actions secrets to Envlet

1. 01

   Sign in once

   Install the CLI and sign in. It shows a URL and a code; approve in the browser and you are in.

   Terminal

   npm install -g @envlet/cli
   envlet login

2. 02

   Create one token for CI

   Add GitHub Actions under Access and create a token for the environment the workflow deploys. The MCP server saves the token to a file for you; the dashboard shows it once.

   ci/github-actionsci

   Its own token, separate from your login.

   token

   envlet_•••••••• shown once

   opens

   one project, one environment

   expires

   always

3. 03

   Set the one secret

   gh secret set reads the token from the file, so it never touches your shell history.

   Terminal

   gh secret set ENVLET_TOKEN < ~/.config/envlet/tokens/ci-staging.token

4. 04

   Rewrite the steps

   Pass ENVLET_TOKEN on the step and put envlet run in front of the command. Every other secrets reference goes away.

   .github/workflows/test.yml

   - name: Test
     env:
       ENVLET_TOKEN: ${{ secrets.ENVLET_TOKEN }}
     run: npx -y @envlet/cli run -- npm test

5. 05

   Delete the old secrets

   Once the workflow is green, delete the old secrets in GitHub. From now on every read shows up in the audit log under GitHub Actions.

6. 06

   Or run the migrate prompt

   With the Envlet MCP server in Claude Code, Cursor, or Codex, the migrate prompt does every step above. Values never enter the conversation.

   Claude Code

   claude mcp add --scope user envlet -- npx -y @envlet/cli mcp

Related

• GitHub Actions
• Production guide