CI and deploy

Official action

Works in GitHub, Gitea, and GitVerse — all three have a compatible runtime.

- uses: aistastudio/env-action@v1
  with:
    url: https://env.aistastudio.ru
    client-id: ${{ secrets.ENVMASTER_CLIENT_ID }}
    client-secret: ${{ secrets.ENVMASTER_CLIENT_SECRET }}
    project: billing-api
    environment: production
    validate: true      # fail before deploy if keys are missing from the schema

Optional inputs: keys narrows the fetch to the listed keys (narrowing is allowed, widening permissions is not), file additionally writes a dotenv file with mode 0600, export-to-env: false disables passing values through environment variables. The keys and count outputs contain only names and the count — never values.

Every value is registered with the runner's log masker before it can be printed, and is passed to $GITHUB_ENV in multiline form — newlines and the equals sign inside a value survive the transfer. Secrets are never printed to stdout.

Any other CI

envmaster export --project billing-api --env production --file deploy.env
# or, better, with no file at all:
envmaster run --project billing-api --env production -- ./deploy.sh

Completeness check before deploy

env.schema.yml describes which keys are required and in which environments:

version: 1
keys:
  - name: DB_PASSWORD
    kind: secret
    required: true
    environments: [staging, production]
  - name: LOG_LEVEL
    kind: var
    required: false

envmaster validate compares the schema with what actually exists in the service and stops the pipeline if a key is missing — before runtime, not after. The check runs on names; values are not disclosed.

What to show in logs

Nothing. If you really need to confirm a key arrived, print its length or a fingerprint prefix, not the value — the masker saves you from accidents, not from deliberate output.