cdqag/Fetch Infisical Secrets
Fetch secrets from Infisical into your Github workflows
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Apr 8, 2026
- License
- MIT
Pinned Snippet
uses: cdqag/infisical-secrets-action@ce6c3002a360657ae2ba907f72d50331006cab2a # v1.6.1tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| method | The authentication method to use | no | universal |
| client-id | Machine Identity client ID | yes | — |
| client-secret | Machine Identity secret key | yes | — |
| identity-id | Machine Identity ID | no | — |
| oidc-audience | Custom aud claim for the signed Github ID token | no | — |
| project-slug | Source project slug | yes | — |
| env-slug | Source environment slug | yes | — |
| domain | Infisical URL (defaults to https://eu.infisical.com ) | no | https://eu.infisical.com |
| export-type | If set to `env`, it will set the fetched secrets as environment variables for subsequent steps of a workflow. If set to `file`, it will export the secrets in a .env file in the defined file-output-path | no | env |
| file-output-path | The path to save the file when export-type is set to `file` | no | /.env |
| secret-path | Source path, example: `/my-secret-path` | no | / |
| include-imports | If set to `true`, it will include imported secrets | no | true |
| recursive | If set to `true`, it will fetch all secrets from the specified base path and all of its subdirectories | no | false |
| retry-attempts | Number of retry attempts for network requests | no | 10 |
| unmask-with-tag | If set, secrets with this tag will not be masked in the GitHub Actions logs | no | unmasked |
| if-not-found | Behavior when no secrets are found. Options are `warn`, `error`, or `ignore` | no | error |
Outputs
no outputs