Skip to content
Holocron

secrets sync

Terminal window
holocron secrets sync <environmentId> [--project-id <id>] [--target production preview] [--dry-run]

Pulls all secrets from a vault environment and fans them out to:

  • CI secrets via the secrets capability (e.g. GitHub Actions secrets)
  • Deployment env vars via the deployment capability (e.g. Vercel env vars) when --project-id is provided

This is the primary way to keep CI and deployment platform secrets in sync with the vault (1Password, Doppler, Infisical, etc.).

Arguments and options

Argument / Option Default Description
<environmentId> (required) Vault environment id to read (provider-specific — e.g. a 1Password Environment id, Doppler config name)
--project-id — Deployment project id (e.g. Vercel prj_xxx). Required when syncing to the deployment capability
--target production preview Deployment targets to sync to (space-separated). Options: development, preview, production
--dry-run false Print what would be set without writing secrets

Examples

Terminal window
# Sync all secrets from the "production" Doppler config to GitHub Actions
holocron secrets sync production


# Also sync to Vercel's production and preview environments
holocron secrets sync production --project-id prj_xxx


# Only sync to production (not preview)
holocron secrets sync production --project-id prj_xxx --target production


# Dry-run to see what would be synced
holocron secrets sync production --dry-run

Flow

  1. The vault capability reads all KEY=VALUE pairs from <environmentId>
  2. Each key is set as a CI secret (via the secrets capability) at repo scope
  3. If --project-id is provided, each key is also set as a deployment env var for each --target

Authentication

  • Vault plugin token (e.g. HOLOCRON_DOPPLER_TOKEN, HOLOCRON_INFISICAL_TOKEN)
  • HOLOCRON_ADMIN_TOKEN / github.admin for writing GitHub secrets
  • Deployment plugin token (e.g. HOLOCRON_VERCEL_TOKEN) if --project-id is used