CI/CD Integration

Restore your app’s config and secret files in build and deployment pipelines using scoped CI tokens.

CI Tokens

Files are end-to-end encrypted, and CI tokens preserve that guarantee. A token has two parts joined by a dot — dvci_<auth>.<key>. When you generate one in the browser, the project encryption key (DEK) is wrapped under the key part, and only a hash of the auth part is sent to the server. In the pipeline the CLI sends just the auth part to authenticate, and uses the key part locally to unwrap the DEK and decrypt files. The server only ever holds ciphertext it cannot decrypt — it never sees the key part or the plaintext. See Encryption & Security for the full model.

CI tokens are long-lived, non-interactive API tokens scoped to a specific app and environment within a project.

Generating a Token

1. Open your project and go to Settings > CI/CD Tokens.
2. Click Generate Token and configure:

3. Unlock your vault (required to wrap the project key), click Generate Token, and copy it — it is shown only once. The full token (including the key part) exists only in your browser at that moment; DepVault cannot show it again.

Token Scoping

Each token is bound to one app and one environment. A ci pull with that token returns the app’s base files plus the files for the token’s selected environment. A compromised token has minimal blast radius — generate separate tokens per app/environment.

Revoking

Revoke tokens at any time from the CI/CD Tokens settings page. Revoked tokens are rejected immediately. Token usage is logged for auditing (timestamp, IP, last used).

CLI Usage

Set DEPVAULT_TOKEN as an environment variable in your CI provider, then run ci pull. The CLI fetches the encrypted blobs, decrypts them client-side, and writes each file to its original repo-relative path, recreating directories:

depvault ci pull

The token alone determines the project, app, and environment — no project, app, or environment flags are needed. Because files are restored verbatim to their paths, your pipeline reads them exactly where your app already expects them (e.g. apps/backend/.env, apps/backend/appsettings.Production.json).

If you need files for multiple apps or environments in the same pipeline, generate a separate token for each and run ci pull once per token.

Pipeline Examples

GitHub Actions

Store DEPVAULT_TOKEN as a repository secret. Use the setup-depvault action to install the CLI and configure the token in one step.

name: Deploy
on:
  push:
    branches: [main]
 
jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
 
      - name: Setup DepVault CLI
        uses: suxrobGM/depvault@v1
        with:
          token: ${{ secrets.DEPVAULT_TOKEN }}
 
      - name: Restore config & secret files
        run: depvault ci pull
 
      - name: Build and deploy
        run: |
          npm ci
          npm run build

ci pull writes each file back to its original path, so build and deploy steps find .env, appsettings.*.json, and secret files exactly where the app expects them. If you need a specific .env exported into the GitHub Actions environment, source it explicitly after the pull:

      - name: Export backend env
        run: cat apps/backend/.env >> $GITHUB_ENV

To restore files for multiple apps or environments, use separate tokens:

- name: Restore backend (prod)
  env:
    DEPVAULT_TOKEN: ${{ secrets.DEPVAULT_BACKEND_PROD_TOKEN }}
  run: depvault ci pull
 
- name: Restore worker (prod)
  env:
    DEPVAULT_TOKEN: ${{ secrets.DEPVAULT_WORKER_PROD_TOKEN }}
  run: depvault ci pull

The action accepts these inputs:

The action runs on Linux, macOS, and Windows runners (ubuntu-*, macos-*, windows-*), across x64 and ARM64. On a Windows runner it installs the win-x64 build automatically — no extra configuration is needed.

GitLab CI

Store DEPVAULT_TOKEN as a masked CI/CD variable.

deploy:
  stage: deploy
  image: node:20
  variables:
    DEPVAULT_TOKEN: $DEPVAULT_TOKEN
  before_script:
    - curl -fsSL https://get.depvault.com | bash
  script:
    - depvault ci pull
    - npm ci
    - npm run build
  only:
    - main

Azure DevOps

Store the token as a secret pipeline variable.

trigger:
  branches:
    include: [main]
 
pool:
  vmImage: "ubuntu-latest"
 
steps:
  - script: curl -fsSL https://get.depvault.com | bash
    displayName: Install DepVault CLI
 
  - script: depvault ci pull
    displayName: Restore config & secret files
    env:
      DEPVAULT_TOKEN: $(DEPVAULT_TOKEN)
 
  - script: npm ci && npm run build
    displayName: Build

Windows Runners

On a Windows GitHub runner, the suxrobGM/depvault action works unchanged. Without the action, install via PowerShell:

  - name: Setup DepVault CLI
    shell: pwsh
    run: irm https://get.depvault.com | iex
 
  - name: Restore config & secret files
    shell: pwsh
    env:
      DEPVAULT_TOKEN: ${{ secrets.DEPVAULT_TOKEN }}
    run: depvault ci pull

Docker Build

Restore files into the build context, then mount the one you need as a build secret without baking it into the image:

depvault ci pull --output .
docker build --secret id=env,src=apps/backend/.env -t myapp .
rm apps/backend/.env

FROM node:20-alpine AS build
WORKDIR /app
COPY . .
RUN --mount=type=secret,id=env,target=/app/.env npm run build
 
FROM node:20-alpine
WORKDIR /app
COPY --from=build /app/dist ./dist
CMD ["node", "dist/index.js"]

Troubleshooting