Encrypt a .env file for GitHub Actions

Encrypt a .env file for GitHub Actions and inject its secrets into your workflow at runtime.

1. Encrypt

Create a CI environment file and encrypt it.

dotenvx encrypt -f .env.ci

Commit the encrypted .env.ci file, but never commit .env.keys.

2. Add the private key to GitHub

Copy DOTENV_PRIVATE_KEY_CI from .env.keys. In your GitHub repository, open Settings → Secrets and variables → Actions, create a repository secret, and name it DOTENV_PRIVATE_KEY_CI.

The encrypted values stay in .env.ci. GitHub stores only the private key needed to decrypt them during the workflow.

3. Run

Install dotenvx, pass the GitHub secret to the step, and run your command through dotenvx run.

name: CI

on: [push, pull_request]

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
      - run: npm ci
      - run: curl -sfS https://dotenvx.sh | sh
      - run: dotenvx run -f .env.ci -- npm test
        env:
          DOTENV_PRIVATE_KEY_CI: ${{ secrets.DOTENV_PRIVATE_KEY_CI }}

Dotenvx decrypts .env.ci and injects its values only into the command it runs.