Passing secrets to act without putting them in a file

[centranoisacs]

I know about act -s MY_SECRET=value and the .secrets file approach. The problem is I have 12 secrets for my workflow and I don't want to:

1. Type them all as -s flags every time (error prone, lands in shell history)
2. Put them in a .secrets file that might accidentally get committed

What I really want is to pull them from my system keychain or from 1Password CLI. Has anyone set up something like this? I was thinking of a wrapper script that does:

act push $(op item get "CI Secrets" --format json | jq -r '.fields[] | "-s \(.label)=\(.value)"')

But I'm not sure if act handles that many -s flags well, and the quoting gets messy with special characters in secret values. Is there a cleaner integration?

[mehvetero]

the .secrets file approach is fine, just make sure it's gitignored before you create it:

echo ".secrets" >> .gitignore

then:

# .secrets
AWS_KEY=xxx
DB_PASS=yyy
STRIPE_SECRET=zzz

act push --secret-file .secrets

for the 1password approach, write to a tmpfile instead of inline expansion — avoids the quoting nightmare with special characters:

op item get "CI Secrets" --format json \
  | jq -r '.fields[] | "\(.label)=\(.value)"' > /tmp/.act-secrets
act push --secret-file /tmp/.act-secrets
rm /tmp/.act-secrets

the tmpfile path is cleaner than chaining -s flags and keeps nothing in shell history.