Vault with GitHub Actions

Run your deployment through gops vault run so Vault injects secrets only into the deploy command.

Configure the pipeline

Add GOPS_API_KEY as a protected secret in GitHub Actions, and set GOPS_PROJECT_ID as a protected variable. The API key must have permission to export Vault secrets for that project.

Deploy with Vault

Add this to .github/workflows/deploy.yml. Change --path, --env, and npm run deploy to match your application.

name: Deploy

on:
  push:
    branches: [main]

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 20
      - run: npm install --global @getgitops/cli
      - run: npm ci
      - run: gops vault run --api-url https://cloud.getgitops.com/api --api-key "$GOPS_API_KEY" --project-id "$GOPS_PROJECT_ID" --path / --env production -- npm run deploy
        env:
          GOPS_API_KEY: ${{ secrets.GOPS_API_KEY }}
          GOPS_PROJECT_ID: ${{ vars.GOPS_PROJECT_ID }}

The command fetches secrets from Vault, makes them available only for the deploy process, and does not write an environment file to the repository or CI workspace.

See the official GitHub Actions documentation for its secret and variable configuration.