GitHub Actions secrets and environment variables

Two layers of secrets

GitHub repository or environment secrets should hold the EANVI API key (and similar automation credentials). Application keys — DATABASE_URL, Stripe, etc. — stay in EANVI and are pulled during the job.

Example workflow sketch

Authenticate non-interactively, pull the bound or named environment, then build and deploy. Use placeholders only; never commit real keys.

name: Deploy
on:
  push:
    branches: [main]
jobs:
  deploy:
    runs-on: ubuntu-latest
    env:
      EANVI_API_KEY: ${{ secrets.EANVI_API_KEY }}
    steps:
      - uses: actions/checkout@v4
      - name: Pull environment
        run: |
          # Install and authenticate the Eanvi CLI, then:
          eanvi pull
      - run: npm ci && npm run build

Map GitHub environments to EANVI environments

Use separate GitHub Environments (staging vs production) with different EANVI API keys or pull targets. That prevents a staging workflow from reading production values.

Rotate the GitHub-stored API key

When a pipeline is retired or access changes, create a new EANVI API key, update the GitHub secret, confirm the workflow, then revoke the old key.