infisical/Fetch Infisical Secrets
Fetch secrets from Infisical into your Github workflows
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Apr 25, 2026
- License
- MIT
Pinned Snippet
uses: infisical/secrets-action@77ab1f4ccd183a543cb5b42435fbd181189f4995 # v1.0.16tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| method | The authentication method to use (universal, oidc, aws-iam) | no | universal |
| client-id | Machine Identity client ID | no | — |
| client-secret | Machine Identity secret key | no | — |
| identity-id | Machine Identity ID | no | — |
| oidc-audience | Custom aud claim for the signed Github ID token | no | — |
| project-slug | Source project slug | yes | — |
| env-slug | Source environment slug | yes | — |
| domain | Infisical URL (defaults to https://app.infisical.com ) | no | https://app.infisical.com |
| export-type | If set to `env`, it will set the fetched secrets as environment variables for subsequent steps of a workflow. If set to `file`, it will export the secrets in a .env file in the defined file-output-path | no | env |
| file-output-path | The path to save the file when export-type is set to `file` | no | /.env |
| secret-path | Source path, example: `/my-secret-path` | no | / |
| include-imports | If set to `true`, it will include imported secrets | no | true |
| recursive | If set to `true`, it will fetch all secrets from the specified base path and all of its subdirectories | no | false |
| extra-headers | Extra headers to add to all requests sent to Infisical | no | "" |
Outputs
no outputs