gh-vault 0.1.1

First public release of gh-vault on PyPI as forgegod-gh-vault.

gh-vault keeps named GitHub tokens and secret project values in GPG-encrypted pass entries, while letting explicitly declared public variables live in a restrictive XDG archive. It archives and restores per-project environments, syncs declared GitHub Actions values, runs local Actions with ephemeral files, and checks workflow wiring — secrets never enter public metadata or ordinary command output.

Install:

uv tool install forgegod-gh-vault

What's in this release

Profile-driven .env resolution

.env and .env.<name> files can now declare secrets by referencing a stored profile by name instead of pasting a token:

# gh-vault: secret forgegod
GITHUB_TOKEN=forgegod
# gh-vault: secret repo-read
DEPLOY_KEY=repo-read

gh-vault env run resolves the reference against the vault at process start, and gh-vault actions sync resolves it before writing the value to GitHub Secrets — so a single source of truth covers both local runs and CI. The directive grammar is documented in README.md and the resolution surface is laid out in docs/envfiles.md.

Token discovery without exposing the vault

gh-vault find --stdin answers "do we already have a token matching this one?" without printing every stored value. It returns matching profile names (and exits 0) or stays silent and exits 1. The stdin format gate from set --stdin is shared, so empty, multiline, or sentinel-masked inputs are rejected before they ever reach the vault.

Hardened set --stdin token gate

The token format gate in gh-vault set --stdin now rejects inputs that look like the masked output gh auth status produces (gh[pousr]_* and github_pat_* runs of *), so a misconfigured pipeline can't store a worthless placeholder. The rules are documented next to the command so operators know what set will accept before piping.

CI and packaging

• .github/workflows/publish.yml publishes tagged builds to PyPI via GitHub Actions trusted publishing. The workflow asserts the tag (stripped of v) equals gh_vault.__version__ before any upload. The PyPI trusted publisher is scoped to forgegod/gh-vault × publish.yml × environment pypi.
• Invalid PyPI classifier Topic :: System :: Systems Administration :: Authentication/Authorization replaced with the valid Topic :: Security.
• 184 pytest tests pass on Python 3.10–3.14.

Notes for operators

• Release flow: bump src/gh_vault/__init__.py, commit on main, push a v tag. No API tokens are stored in GitHub.
• The PyPI project is registered as forgegod-gh-vault; the installed console script is gh-vault.
• docs/RELEASING.md is the source of truth for the publish contract.