Push targets
A push target is a place that needs your secrets, such as CI secrets or a hosting platform's environment variables. Define one under [targets.<name>], list it in a secret's push field, and run fnox push. See the push guide for how pushing works, profiles, and what it protects.
| Target | Config type | Sets | Through | Readable afterwards |
|---|---|---|---|---|
| GitHub Actions | github-actions | Actions, Dependabot and Codespaces secrets | gh CLI | No |
| GitLab CI/CD | gitlab-ci | Project and group CI/CD variables | glab CLI | Yes, by maintainers |
| Vercel | vercel | Project environment variables | vercel CLI | No, with sensitive |
| Cloudflare Workers | cloudflare-workers | Worker secrets | wrangler CLI | No |
| Fly.io | fly | App secrets | fly CLI | No |
| Forgejo and Gitea | forgejo-actions | Repository and organization Actions secrets | REST API | No |
| HCP Terraform | hcp-terraform | Workspace variables | REST API | No, with sensitive |
| Azure Container Apps | azure-container-apps | Container environment variables | REST API | Yes, by app readers |
Every target replaces an existing value with the same name. CLI-based targets receive the value on stdin, so it never appears in a process listing, and use whatever login their CLI already has. API-based targets read a token from the environment, except Azure Container Apps, which uses the Azure login chain.
Experimental
Push targets are new, and their config format may change.