infisical-ci-setup

Infisical CI Setup Command

Generate CI/CD pipeline configuration for injecting Infisical secrets into builds and deployments.

Parse Arguments

Extract from user input:

• provider: github, gitlab, circleci, jenkins, or bitbucket

Workflow

Step 1: Determine CI Provider

Ask user which CI/CD provider they use:

1. GitHub Actions
2. GitLab CI
3. CircleCI
4. Jenkins
5. Bitbucket Pipelines

Step 2: Create Machine Identity

Guide user through Infisical dashboard:

1. Go to Organization Settings > Machine Identities
2. Click Create Identity
3. Name: ci-<provider>-<project> (e.g., ci-github-myapp)
4. Add Universal Auth method
5. Copy Client ID and Client Secret
6. Add identity to the project with access to required environments

Step 3: Store Credentials in CI

Guide user to add these secrets to their CI provider:

Secret Name	Value
INFISICAL_UNIVERSAL_AUTH_CLIENT_ID	Client ID from step 2
INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET	Client Secret from step 2

For self-hosted, also add: | INFISICAL_API_URL | https://secrets.company.com/api |

Step 4: Generate Pipeline Config

GitHub Actions

Create .github/workflows/deploy.yml (or add to existing):

name: Deploy

on:
  push:
    branches: [main]

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Infisical CLI
        run: |
          curl -1sLf 'https://dl.cloudsmith.io/public/infisical/infisical-cli/setup.deb.sh' | sudo -E bash
          sudo apt-get update && sudo apt-get install -y infisical

      - name: Authenticate with Infisical
        run: |
          infisical login --method=universal-auth \
            --client-id=${{ secrets.INFISICAL_UNIVERSAL_AUTH_CLIENT_ID }} \
            --client-secret=${{ secrets.INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET }}
        env:
          INFISICAL_DISABLE_UPDATE_CHECK: "true"

      - name: Build with secrets
        run: infisical run --env=production -- npm run build

      - name: Deploy
        run: infisical run --env=production -- npm run deploy