direnv-action(1) GitHub Actions v1.4.6

Evaluate .envrc inside CI.

A compact action for installing direnv, exporting a trusted environment, validating required names, and carrying those variables into later workflow steps.

Repository GitHub network dependents
workflow trace no values printed 
$ direnv allow child
allowed .envrc
$ direnv export json
exported: CHILD_ENV, PATH, SECRET1
$ validate required
found: CHILD_ENV, SECRET1
$ mask secrets
redacted configured values
Runtime Node 24 action, bundled in dist/index.js.
Source Reads the selected directory's .envrc.
Output Exports variables to later steps; custom outputs are not defined.
Safety Use only with trusted repositories and trusted .envrc files.
Start here

Minimal workflow

Pin an exact release for repeatable builds. Use @v1 only when the workflow should receive compatible updates automatically.

.github/workflows/example.yml
steps:
  - uses: actions/checkout@v7
  - uses: HatsuneMiku3939/direnv-action@v1.4.6
    with:
      direnvVersion: 2.37.1
      masks: SECRET1, SECRET2
This action logs exported variable names for debugging, but it does not print environment variable values.
Dependency graph

Who uses this action

dependents.info renders public GitHub dependency graph dependents for this repository.

Repositories that depend on direnv-action
Contract

Inputs

Name Default Use it for
direnvVersion 2.37.1 Selecting the direnv binary version installed from release assets or cache.
direnvChecksum '' Optionally pinning the SHA-256 digest expected for the downloaded direnv binary.
masks '' Comma-separated environment variable names whose exported values should be redacted from logs.
required '' Newline-delimited environment variable names that must exist after direnv export json.
path . Directory where direnv allow and direnv export json run.
Patterns

Common configurations

Pin direnv

Use a known direnv version when workflow behavior must stay stable. Cold installs verify the binary digest before execution or caching.

direnvVersion
- uses: HatsuneMiku3939/direnv-action@v1.4.6
  with:
    direnvVersion: 2.37.1

Pin the binary digest

By default the action uses the GitHub Release API asset digest. Provide direnvChecksum for an independent SHA-256 pin.

direnvChecksum
- uses: HatsuneMiku3939/direnv-action@v1.4.6
  with:
    direnvVersion: 2.37.1
    direnvChecksum: sha256:1f1b93dd6f38523fde26dfac96151ef9d31a374e3005cd3345fb93555ae0c9b5

Mask secrets

List exported variable names. Do not paste raw secret values into masks.

masks
- uses: HatsuneMiku3939/direnv-action@v1.4.6
  with:
    masks: SECRET1, SECRET2

Require names

Fail the step before exporting anything when expected variables are missing.

required
- uses: HatsuneMiku3939/direnv-action@v1.4.6
  with:
    required: |
      AWS_REGION
      DATABASE_URL
      NODE_AUTH_TOKEN

Use a subdirectory

Point path at the directory containing the target .envrc.

path
- uses: HatsuneMiku3939/direnv-action@v1.4.6
  with:
    path: child
When it fails

Troubleshooting

Required variables are missing

Check that path points at the intended .envrc and that direnv export json exports every name listed in required.

Secret values still appear

Confirm masks contains variable names such as SECRET1, not the secret values.

PATH changes are not visible

When .envrc exports PATH, the action appends it through the GitHub Actions path API. Later steps in the same job receive the updated path.

Downloaded direnv checksum mismatch

Confirm direnvVersion and direnvChecksum refer to the same upstream binary. If direnvChecksum is not set, retry after checking that the upstream GitHub release asset metadata is available.

Trust boundary

Security

.envrc is executable project configuration. Treat it as code, especially in workflows that can access repository secrets, cloud credentials, deployment tokens, or production infrastructure.
  • Run this action only with trusted repositories and trusted .envrc contents.
  • Cold installs verify the downloaded direnv binary before making it executable or saving it to cache. By default this uses the GitHub Release API asset digest; set direnvChecksum for a stronger independent pin.
  • Avoid evaluating untrusted fork contents from pull_request_target workflows. If you use pull_request_target, do not check out and run a fork-provided .envrc in a job that has access to secrets.
  • Prefer running secret-bearing jobs only on trusted refs, protected branches, or reviewed tags. For fork PR validation, use pull_request with minimal permissions and without repository secrets unless the .envrc contents are trusted.
  • Use the required input to fail early when expected exported variables are missing. This helps prevent downstream steps from running with incomplete configuration, but it is not a sandbox or a secret-protection boundary.
  • Keep workflow permissions: as narrow as possible and avoid passing long-lived credentials into jobs that evaluate changing .envrc files.
  • Use masking as log redaction, not as a complete secret protection boundary.
  • Keep sensitive logic inside trusted workflow contexts whenever possible.
Publishing

Maintainers

This site is published from GitHub Pages using branch master and folder /docs. Keep this page aligned with README.md and action.yml.

When preparing a release that changes the exact pinned tag, update both README.md and this page.