CI Integration

Use --ci to exit with code 1 when errors are found, and --no-color for clean log output.

GitHub Actions

The quickest way is the published action:

- uses: albertoarena/envaudit@v1
  with:
    ignore-empty: true   # secrets injected at runtime

Inputs (all optional):

Input	Default	Description
command	check	Command to run: check, sync or doc
env	.env	Path to the .env file
example	.env.example	Path to the .env.example file
ci	true	Exit with code 1 if errors are found
ignore-empty	false	Skip empty value warnings
no-color	true	Disable colored output

The tool version is whatever action tag you pin (@v1, @v1.1.0). You can also call the CLI directly:

- name: Audit env files
  run: npx @albertoarena/envaudit check --ci --no-color

The gitignored .env catch

.env is usually gitignored, so on a fresh checkout only .env.example exists and check has nothing to compare against. Two realistic setups:

A. Validate .env.example only — typical for public repos. Catches leaked secrets, unquoted values with spaces, and duplicate keys in the example file itself:

- run: cp .env.example .env
- uses: albertoarena/envaudit@v1
  with:
    ignore-empty: true

B. Validate the real env in a deploy pipeline — build .env from GitHub Secrets, then confirm nothing declared in the example is missing before shipping:

- name: Build .env
  run: |
    cp .env.example .env
    echo "DB_PASSWORD=${{ secrets.DB_PASSWORD }}" >> .env
    echo "APP_KEY=${{ secrets.APP_KEY }}" >> .env
- uses: albertoarena/envaudit@v1

GitLab CI

audit-env:
  script:
    - cp .env.example .env
    - npx @albertoarena/envaudit check --ci --no-color --ignore-empty

Other CI systems

envaudit works in any environment with Node.js >= 18. The --ci flag ensures the build fails when:

• Variables are defined in .env.example but missing from .env
• Real secrets are detected in .env.example

Warnings (undocumented variables, empty values) are reported but do not cause a non-zero exit code.