GitHub Actions

The github-actions target sets GitHub Actions secrets with gh secret set, which handles GitHub's encryption. It can also set Dependabot and Codespaces secrets.

Config type	github-actions
Requires	gh, logged in with gh auth login as someone who can manage secrets
Readable afterwards	No. GitHub stores secrets encrypted and never returns them

Quick start

[targets.gh-prod]
type = "github-actions"
repo = "acme/api"
environment = "production"

[secrets]
STRIPE_KEY = { provider = "op", value = "Stripe/secret key", push = ["gh-prod"] }

fnox push --dry-run
fnox push

Without repo, gh uses the repository of the current directory.

Configuration

Field	Default	Description
repo	current repository	Repository as owner/name.
environment	none	Deployment environment to set the secret in, instead of the repository.
org	none	Organization to set the secret in. Conflicts with repo and environment.
visibility	GitHub's default	For an org secret: "all", "private", or "selected" repositories.
repos	none	For visibility = "selected": the repositories that can use the secret.
app	"actions"	"actions", "dependabot", or "codespaces". Environments exist only for Actions.

[targets.org-deps]
type = "github-actions"
org = "acme"
visibility = "selected"
repos = ["api", "web"]
app = "dependabot"

Notes

• The secret name is the fnox key. GitHub reserves names that start with GITHUB_, so fnox refuses to push such a key before it writes anything.