Skip to main content

​
Forward a local secret

Declare the name, then supply its value in your local environment or ignored .env file before deploying:
A missing required value fails deployment before release submission. Use optional: true only if the application handles an absent value. Resolved secrets override matching env entries. Never paste actual credentials into documentation, command history, or source control.

​
Generate an application credential

Credentials use a named map, not a list:
Without envVar, the injected name is CRED_ADMIN_TOKEN. Incremental deployment requires generate: true; supply externally managed credentials through secrets or env. Keep environment names valid and distinct.

​
Deploy and verify

Run rig deploy --workspace my-project locally. Confirm the app accepts its credential through its normal authenticated flow. Do not print the value to prove injection succeeded. The secrets declaration prevents storing a value in rig.yaml; it does not make app environment metadata an encrypted vault. Authorized environment/API readers can access stored values. Rotate a disclosed credential and redeploy, then revoke the old value at its provider if applicable. For Actions, map a GitHub repository secret into the deployment step’s env; see GitHub Actions.