Move from GitHub Actions secrets to Envlet

Replace every repository secret with one, and stop copying the same value into five workflows.

About 15 minutes

01
Sign in once
Install the CLI and sign in. It shows a URL and a code; approve in the browser and you are in.
Terminal
```
npm install -g @envlet/cli
envlet login
```
02
Create a CI identity and one token
Create a ci identity for GitHub Actions and a token for the environment the workflow deploys. The MCP server saves the token to a file for you; the dashboard shows it once.
03
Set the one secret
gh secret set reads the token from the file, so it never touches your shell history.
Terminal
```
gh secret set ENVLET_TOKEN < ~/.config/envlet/tokens/ci-staging.token
```
04
Rewrite the steps
Pass ENVLET_TOKEN on the step and put envlet run in front of the command. Every other secrets reference goes away.
.github/workflows/test.yml
```
- name: Test
  env:
    ENVLET_TOKEN: ${{ secrets.ENVLET_TOKEN }}
  run: npx -y @envlet/cli run -- npm test
```
05
Delete the old secrets
Once the workflow is green, delete the old secrets in GitHub. From now on every read shows up in the audit log under the ci identity.
06
Or say the word
With the Envlet MCP server in Claude Code, Cursor, or Codex, this whole guide is one sentence: move us to Envlet. The agent does every step above, and no value ever enters the conversation.
Claude Code
```
claude mcp add --scope user envlet -- npx -y @envlet/cli mcp
```

Stop pasting .env files.

One command. The right values for whoever runs it.