Infisical CI/CD Integration

Patterns for integrating Infisical secret injection into CI/CD pipelines and deployment targets.

GitHub Actions

Standard Pattern

- name: Install Infisical CLI
  run: |
    curl -1sLf 'https://dl.cloudsmith.io/public/infisical/infisical-cli/setup.deb.sh' | sudo -E bash
    sudo apt-get update && sudo apt-get install -y infisical

- name: Authenticate
  run: |
    infisical login --method=universal-auth \
      --client-id=${{ secrets.INFISICAL_UNIVERSAL_AUTH_CLIENT_ID }} \
      --client-secret=${{ secrets.INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET }}
  env:
    INFISICAL_DISABLE_UPDATE_CHECK: "true"

- name: Run with secrets
  run: infisical run --env=production -- npm run build

Multi-Environment Deploy

jobs:
  deploy-staging:
    runs-on: ubuntu-latest
    steps:
      # ... install + auth steps ...
      - run: infisical run --env=staging -- npm run deploy

  deploy-production:
    needs: deploy-staging
    runs-on: ubuntu-latest
    steps:
      # ... install + auth steps ...
      - run: infisical run --env=production -- npm run deploy

Export as Environment Variables

When tools need env vars directly (not via infisical run):

- name: Export secrets
  run: |
    infisical export --env=production --format=dotenv >> $GITHUB_ENV

GitLab CI

Standard Pattern

variables:
  INFISICAL_DISABLE_UPDATE_CHECK: "true"

.infisical-setup:
  before_script:
    - curl -1sLf 'https://dl.cloudsmith.io/public/infisical/infisical-cli/setup.deb.sh' | bash
    - apt-get update && apt-get install -y infisical
    - infisical login --method=universal-auth
        --client-id=$INFISICAL_UNIVERSAL_AUTH_CLIENT_ID
        --client-secret=$INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET

build:
  extends: .infisical-setup
  script:
    - infisical run --env=production -- npm run build

GitLab OIDC Integration

deploy:
  id_tokens:
    GITLAB_OIDC_TOKEN:
      aud: https://app.infisical.com
  script:
    - infisical login --method=oidc
        --machine-identity-id=$MACHINE_IDENTITY_ID
    - infisical run --env=production -- npm run deploy

Docker Patterns

Runtime Injection (Preferred)

# Install CLI in the image
FROM node:20-alpine
RUN apk add --no-cache curl bash && \
    curl -1sLf 'https://dl.cloudsmith.io/public/infisical/infisical-cli/setup.rpm.sh' | bash && \
    apk add infisical

COPY . .
RUN npm ci

# Inject at runtime via entrypoint
CMD ["infisical", "run", "--env=production", "--", "node", "server.js"]

Run with credentials:

docker run \
  -e INFISICAL_UNIVERSAL_AUTH_CLIENT_ID=... \
  -e INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET=... \
  -e INFISICAL_DISABLE_UPDATE_CHECK=true \
  myapp

Build-Time Export (When Needed)

FROM node:20-alpine AS builder
RUN apk add --no-cache curl bash && \
    curl -1sLf 'https://dl.cloudsmith.io/public/infisical/infisical-cli/setup.rpm.sh' | bash && \
    apk add infisical

ARG INFISICAL_UNIVERSAL_AUTH_CLIENT_ID
ARG INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET
ENV INFISICAL_DISABLE_UPDATE_CHECK=true

RUN infisical login --method=universal-auth \
    --client-id=$INFISICAL_UNIVERSAL_AUTH_CLIENT_ID \
    --client-secret=$INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET

COPY . .
RUN infisical run --env=production -- npm run build

# Clean image - no CLI, no secrets
FROM node:20-alpine
COPY --from=builder /app/dist ./dist
COPY --from=builder /app/node_modules ./node_modules
CMD ["node", "dist/index.js"]

Docker Compose

services:
  app:
    build: .
    environment:
      - INFISICAL_UNIVERSAL_AUTH_CLIENT_ID=${INFISICAL_UNIVERSAL_AUTH_CLIENT_ID}
      - INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET=${INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET}
      - INFISICAL_DISABLE_UPDATE_CHECK=true
    command: infisical run --env=production -- node server.js

Or inject before compose:

infisical run --env=dev -- docker compose up

Kubernetes Patterns

Native Kubernetes Auth

apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp
spec:
  template:
    spec:
      serviceAccountName: infisical-sa
      containers:
        - name: app
          image: myapp:latest
          env:
            - name: INFISICAL_MACHINE_IDENTITY_ID
              value: "<machine-identity-id>"
            - name: INFISICAL_DISABLE_UPDATE_CHECK
              value: "true"
          command: ["infisical", "run", "--method=kubernetes", "--env=production", "--", "node", "server.js"]

Init Container Pattern

apiVersion: apps/v1
kind: Deployment
spec:
  template:
    spec:
      initContainers:
        - name: fetch-secrets
          image: infisical/cli:latest
          command:
            - sh
            - -c
            - |
              infisical login --method=kubernetes \
                --machine-identity-id=$MACHINE_IDENTITY_ID
              infisical export --env=production > /secrets/.env
          env:
            - name: MACHINE_IDENTITY_ID
              value: "<machine-identity-id>"
          volumeMounts:
            - name: secrets
              mountPath: /secrets
      containers:
        - name: app
          image: myapp:latest
          command: ["sh", "-c", "source /secrets/.env && node server.js"]
          volumeMounts:
            - name: secrets
              mountPath: /secrets
              readOnly: true
      volumes:
        - name: secrets
          emptyDir:
            medium: Memory

Serverless Patterns

Vercel

# Export secrets to Vercel environment
infisical export --env=production --format=dotenv | while IFS='=' read -r key value; do
  vercel env add "$key" production <<< "$value"
done

AWS Lambda

# Update Lambda env vars
infisical export --env=production --format=json | \
  aws lambda update-function-configuration \
    --function-name myfunction \
    --environment "Variables=$(cat)"

Cloudflare Workers

# Set wrangler secrets
infisical export --env=production --format=dotenv | while IFS='=' read -r key value; do
  echo "$value" | wrangler secret put "$key"
done

Security Best Practices

1. Separate identities per environment - staging CI should NOT access production
2. Minimal scope - grant only the environments and folders needed
3. Set `INFISICAL_DISABLE_UPDATE_CHECK=true` in all CI environments
4. Never log secrets - use --silent flag when listing secrets in CI
5. Rotate credentials on a schedule (90 days recommended)
6. Use OIDC when available (GitLab, GitHub) to avoid long-lived credentials
7. Never bake secrets into Docker image layers
8. Use memory-backed volumes for Kubernetes secret files (emptyDir.medium: Memory)