Environment files and secrets

The repository vault

Use Secrets for encrypted environment files. Root .env files must be covered by .gitignore. orbitgit commit vaults tracked root .env files and removes them from tracking before committing. orbitgit push synchronizes these files before pushing Git data.

# Add your env patterns to .gitignore first.
orbitgit secrets push
orbitgit secrets pull

Rejected pushes

The server also checks pushes for environment values. A rejection can vault detected files, but the offending commit is not accepted. Remove the files from the index or history as needed, then push sanitized commits. Removing only the latest copy may leave values in earlier commits.

Builds and release archives

Vault values are not automatically exported to CI. Add required secrets to your GitHub workflow; the generated job credential cannot read the vault.

Inspect release archives for embedded private files or credentials. Git push checks do not sanitize arbitrary release archives.