CI/CD integration

Use a dedicated organization API key in your CI secret store. Never use a personal password.

Pattern

1. Create an API key named for the pipeline (for example github-actions-prod).
2. Store it as EANVI_API_KEY in CI secrets.
3. Install the CLI (or call the SDK).
4. eanvi pull into .env or export variables before build/deploy.

GitHub Actions

name: Deploy
on:
  push:
    branches: [main]

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Install Eanvi CLI
        run: npm install -g @eanvi/cli

      - name: Pull production secrets
        env:
          EANVI_API_KEY: ${{ secrets.EANVI_API_KEY }}
        run: |
          eanvi login --api-key "$EANVI_API_KEY" --org acme
          eanvi pull \
            --project my-app \
            --environment production \
            --output .env \
            --force

      - name: Build
        run: npm ci && npm run build

Mask job logs. Prefer writing .env only for the job filesystem — do not upload it as an artifact.

SDK in a Node build step

import { createClient } from '@eanvi/sdk';
import { writeFileSync } from 'node:fs';

const client = createClient({ apiKey: process.env.EANVI_API_KEY! });
const { secrets } = await client.cli.pull({
  project: 'my-app',
  environment: 'production',
});

const body = Object.entries(secrets)
  .map(([key, value]) => `${key}=${JSON.stringify(value)}`)
  .join('\n');

writeFileSync('.env', body + '\n');

Environment matrix

Use separate API keys when possible so a leaked staging key cannot pull production.

Hardening checklist

• API key stored only in CI secrets
• Key scoped/named and rotated on schedule
• .env not uploaded as build artifact
• Reveal-heavy steps avoided in logs (eanvi list without --reveal)
• Fail the job if eanvi pull fails (do not fall back to stale files)

Related

• CLI workflows
• Security best practices