---
title: GitHub Dotenv Secrets
description: Import simple .env keys into GitHub Actions repository secrets with gh.
sidebar:
  order: 15
---

`gh-import-dotenv-to-secrets` is a small helper for copying simple `.env` entries into GitHub Actions repository secrets.

Use it only in the repository that should receive the secrets. It has no dry-run mode and `gh secret set` overwrites secrets with matching names.

:::caution[Read the file first]
Inspect `.env` before running this helper. Do not use it on untrusted files or in the wrong repository.
:::

## Input format

The script reads `.env` from the current directory:

```text
KEY=value
QUOTED="value"
SINGLE_QUOTED='value'
```

It skips empty keys and lines whose key starts with `#`.

For each remaining line, it strips one leading and trailing single or double quote from the value, then runs:

```bash
gh secret set "$key" -b"$value_no_quotes"
```

## Run it

From the target GitHub repository:

```bash
gh auth status
gh repo view --json nameWithOwner
gh-import-dotenv-to-secrets
```

Verify the resulting secret names:

```bash
gh secret list
```

## What it is not

This helper is not a full dotenv parser. Avoid using it for:

- Multiline values.
- `export KEY=value` syntax.
- Values containing unescaped `=` that need exact dotenv parsing semantics.
- Environment or organisation secrets.
- Selective import.

For those cases, use `gh secret set` directly.

## Safer manual alternative

For one or two secrets, prefer setting them explicitly:

```bash
gh secret set MY_SECRET -b"$MY_SECRET"
```

That keeps the target secret name and value source obvious.

## Troubleshooting

If the command writes to the wrong repository, stop and rotate or replace the affected secrets in GitHub. Then rerun from the correct repository.

If a value imports with quotes still attached, set that secret manually with `gh secret set`. This wrapper only strips a simple matching quote at the beginning and end.

If `gh secret set` fails, check GitHub authentication and repository permissions:

```bash
gh auth status
gh repo view --json nameWithOwner
```