Your .env. Your CI. In sync.

The problem

A common deployment problem looks simple: local .env changes, developer updates application code, CI/CD still holds outdated secret values, and deployments fail or silently leak errors.

Installation & dry-run

Install as a development dependency:

pnpm add -D @hardmachinelabs/env-sync

Always start with a dry run to inspect the planned mutations:

env-sync --provider=github --env=production --dry-run

Monorepo-aware secret names

In multi-package workspaces, env-sync automatically namespaces secrets based on package directory structure:

• Root: DATABASE_URL → DATABASE_URL
• packages/blog/.env: RESEND_API_KEY → BLOG_RESEND_API_KEY

Safety model

env-sync synchronizes variables discovered in local .env files into CI targets; it does not manage remote secret deletion or act as an organization-wide secrets manager. Every sync supports a non-destructive dry-run (--dry-run) to inspect discovered keys and planned mutations before writing. Line-based workflow diffs should always be reviewed before committing.