Envlet on GitHub Actions

One repository secret replaces every other secret in the workflow. Steps run through envlet run and read values the normal way.

ENVLET_TOKENset with gh

Set up

Three steps. The host keeps one secret and everything else arrives at boot.

01
Create a token
Add GitHub Actions under Access and create a token for the environment it deploys.
ci/github-actionsci
Its own token, separate from your login.
token
envlet_•••••••• shown once
opens
one project, one environment
expires
always
02
Set one secret
gh secret set reads the token from the file the MCP server or dashboard gave you, so the value never touches your shell history.
Set the token
gh secret set ENVLET_TOKEN < ~/.config/envlet/tokens/ci-staging.token

Pass the secret as ENVLET_TOKEN on the step and prefix the command with envlet run.

Workflow step

- name: Test
  env:
    ENVLET_TOKEN: ${{ secrets.ENVLET_TOKEN }}
  run: npx -y @envlet/cli run -- npm test

One secret in GitHub Actions. Rotate everything else in Envlet without touching the host.

GitHub Actions / production / environment variables1 secret

ENVLET_TOKEN	envlet_••••••••	the only secret the host keeps
DATABASE_URL	••••••••	moved to Envlet
STRIPE_KEY	••••••••	moved to Envlet
SENTRY_DSN	••••••••	moved to Envlet

Will my app start if Envlet is down?

No. It retries for a few seconds, then fails so you notice. It never starts with half an environment.

Do I still need GitHub Actions's own secret store?

Only for ENVLET_TOKEN. Everything else lives in Envlet, so you rotate in one place.

One command. The right values for whoever runs it.