Secure secrets for CI/CD pipelines
CI/CD systems need credentials to build, test, and deploy. Those secrets should come from a managed vault with non-interactive authentication — not from committed files.
Why pipelines need a different auth path
Interactive browser login does not work in headless CI. EANVI supports API keys so pipelines can authenticate and pull the correct environment.
Recommended pattern
Store a scoped API key in your CI secret store. In the job, authenticate the CLI or call the API, pull the target environment, then run build and deploy steps.
# Conceptual GitHub Actions sketch — use placeholders only
# env:
# EANVI_API_KEY: ${{ secrets.EANVI_API_KEY }}
# steps:
# - run: eanvi pull
# - run: npm run buildKeep production pulls intentional
Map staging and production to separate EANVI environments. Restrict which workflows can pull production, and rotate CI API keys when pipelines or vendors change.
Related resources
Try EANVI
Create a workspace, import a .env, and pull secrets from the CLI.