direnv action

Provides environment variables via direnv

This action provides environment variables via direnv, evaluates the target .envrc, and exports the resulting environment variables to subsequent workflow steps.

Documentation site: https://hatsunemiku3939.github.io/direnv-action/

How it works

The action performs the following steps:

1. Installs the requested direnv version from the GitHub release assets or a cache.
2. Runs direnv allow for the configured path.
3. Runs direnv export json in the configured path.
4. Logs the exported environment variable names without printing their values.
5. Optionally verifies that required environment variable names were exported.
6. Exports the resulting variables to the GitHub Actions environment.
7. Appends PATH entries through core.addPath() when PATH is present in the exported values.
8. Masks configured secret values with the GitHub Actions masking API.

Inputs

• direnvVersion: The direnv version to use. Default: 2.37.1.
• masks: A comma-separated list of environment variable names to mask. Default: ''.
• required: A newline-delimited list of environment variable names that must be exported. Default: ''.
• path: The directory where direnv allow and direnv export json are executed. Default: ..

Outputs

No outputs

Example usage

Examples below pin the current release, v1.3.7. If you prefer compatible updates within the current major line, use the moving major tag @v1.

uses: HatsuneMiku3939/direnv-action@v1.3.7
with:
  direnvVersion: 2.37.1
  masks: SECRET1, SECRET2

This loads the .envrc file from the repository root.

To evaluate the .envrc in a subdirectory, set path explicitly:

uses: HatsuneMiku3939/direnv-action@v1.3.7
with:
  path: child
  masks: SECRET1, SECRET2

To fail early when expected variables are not exported, set required:

uses: HatsuneMiku3939/direnv-action@v1.3.7
with:
  required: |
    AWS_REGION
    DATABASE_URL
    NODE_AUTH_TOKEN

For the most predictable builds, pin an exact version tag such as @v1.3.7. Use @v1 only when you want to receive the latest compatible v1.x.y release automatically.

Behavior notes

• masks accepts environment variable names, not raw secret values.
• required accepts environment variable names, not raw values, and fails when any listed name is absent from the exported environment.
• When .envrc exports PATH, the action appends it to the job PATH instead of overwriting the entire value.
• Variables exported by direnv export json are available to later workflow steps in the same job.
• The action logs exported variable names for debugging, but it does not print environment variable values.
• The action does not define custom outputs; consumers should read exported environment variables directly.

Security considerations

This action evaluates .envrc, which means repository code can influence the shell commands executed by direnv.

• Only use this action with trusted repositories and trusted .envrc contents.
• Review fork-based pull request workflows carefully before allowing this action to run with secrets.
• Treat masking as a log redaction aid, not a complete secret protection boundary.
• Keep sensitive logic inside trusted workflow contexts whenever possible.

Development

Run the local quality checks before packaging or releasing changes:

npm run lint
npm test

For release preparation, use the full gate so the generated dist/ artifacts stay in sync:

npm run all

The Vitest unit tests cover binary URL selection, tool installation cache branches, environment export behavior, required variable validation, secret masking, and the main action flow with mocked GitHub Actions APIs.

Supported platforms and architectures

Since v1.0.7, the following platform and architecture combinations are supported.

Platform	Architecture
Linux	x86_64
Linux	arm64
Darwin	x86_64
Darwin	arm64

Versions earlier than v1.0.7 support only linux-x86_64.

Contributors

Kim SeungSu

hopisaurus

Mike Dial

gidoichi

Alex Klinkert