.env to GitHub Actions Secrets

What is .env to GitHub Actions?

This tool converts a .env file into a shell script of gh secret set commands — one per variable — for bulk-importing them as GitHub Actions repository secrets via the official GitHub CLI.

How it works

GitHub Actions secrets are encrypted client-side against a repository-specific public key and stored on GitHub's servers — there's no API a static, browser-only site can call to set them directly. So instead of pretending to upload anything, the tool generates the exact gh secret set KEY --body '<value>' command for each parsed variable, single-quoting the value (and escaping any literal single quotes inside it) so it survives the shell unmodified. The script starts with a #!/usr/bin/env bash shebang and a comment pointing at the GitHub CLI docs, and ends with a commented-out env: block showing exactly how to reference each secret in a workflow file afterward.

Features

• One gh secret set command per variable, correctly shell-quoted
• Includes a commented reference block showing the ${{ secrets.KEY }} syntax for every key, ready to paste into a workflow
• Handles quoted values and inline comments the same way as the other .env converters
• Copy, download as a runnable .sh script, or load sample data

Example

Input:

DATABASE_URL=postgres://user:pass@localhost:5432/mydb
API_KEY="sk_live_abc123"
DEBUG=false
PORT=3000

Output:

#!/usr/bin/env bash
# Requires the GitHub CLI, authenticated: https://cli.github.com
# Run from inside the repo (or add --repo owner/name to each line).

gh secret set DATABASE_URL --body 'postgres://user:pass@localhost:5432/mydb'
gh secret set API_KEY --body 'sk_live_abc123'
gh secret set DEBUG --body 'false'
gh secret set PORT --body '3000'

# Reference them in a workflow like:
# env:
#   DATABASE_URL: ${{ secrets.DATABASE_URL }}
#   API_KEY: ${{ secrets.API_KEY }}
#   DEBUG: ${{ secrets.DEBUG }}
#   PORT: ${{ secrets.PORT }}

Common errors

Running the script without gh auth login first fails immediately — the CLI needs an authenticated session with access to the target repo. Running it from outside the repo (and without --repo owner/name added to each line) fails because gh can't infer which repository to target. "No KEY=value lines found" means nothing in the pasted text parsed as a valid assignment.

Best practices

This script contains real secret values as plain-text shell arguments — run it once, then delete it, and never commit it to version control (treat it exactly like the source .env file). Shell history can also retain the command line, so consider running it from a file rather than pasting each line interactively if your shell logs history persistently.