How to manage environment variables in GitHub Actions

Repository secrets are fine for one repo and painful for ten. Keep values in one place and pull them into each workflow, with no marketplace action to trust.

Get started free Read the docs

The problem

GitHub secrets are stored per repository or organization, and you cannot read them back. When the same database URL is used by three repos and a server, rotating it means editing every copy by hand.

It also leaves the repo secrets and your runtime config as two sources of truth that quietly diverge.

How to do it with SnapEnv

Store one token in GitHub

Create a read-scoped access token in SnapEnv, limited to the project and environment the job needs, and save it as the SNAPENV_TOKEN repository secret.

Install the CLI in the job

The install script puts the binary in ~/.local/bin, so append it to GITHUB_PATH for later steps.

- name: Install snapenv
  run: |
    curl -fsSL https://get.snapenv.io/install.sh | sh
    echo "$HOME/.local/bin" >> "$GITHUB_PATH"

Pull the variables

When running in GitHub Actions, snapenv pull appends every variable to GITHUB_ENV, so later steps can use them directly.

- name: Pull secrets
  env:
    SNAPENV_TOKEN: ${{ secrets.SNAPENV_TOKEN }}
    SNAPENV_PROJECT: ${{ vars.SNAPENV_PROJECT }}
    SNAPENV_ENV: prod
  run: snapenv pull --env prod

Change a value once

Update the variable in SnapEnv and the next workflow run, on any repo, picks it up. Each pull is recorded in the audit log.

Frequently asked questions

Do I need a third-party GitHub Action?

No. The CLI runs as a normal step, so there is no marketplace action in your supply chain.

Are secrets masked in the logs?

Use snapenv run to inject variables into a single command without writing them to disk, which also scrubs their values from the command's output.

Can I limit what a workflow can read?

Yes. Tokens can be scoped to a single project and environment, and set to read-only.

Can I avoid downloading the CLI every run?

Yes. Cache ~/.local/bin/snapenv with actions/cache, as shown in the GitHub Actions docs.

Free for small teams. Set up in minutes.

3 projects, 3 members, full CLI and Kubernetes operator. No credit card.

Get started free