Check Environment Variables & Secrets

A reusable GitHub Action that verifies all required environment variables and secrets are set before your workflow continues. Instead of duplicating validation logic across workflows, simply list the names you need — the action does the rest.

Usage

- name: Check required variables & secrets
  uses: superhuit-agency/check-env-vars-secrets@v1
  with:
    variables: |
      MY_SECRET
      MY_VAR
      ANOTHER_VAR
  env:
    MY_SECRET: ${{ secrets.MY_SECRET }}
    MY_VAR: ${{ vars.MY_VAR }}
    ANOTHER_VAR: ${{ vars.ANOTHER_VAR }}

The action checks each listed name against the environment exposed to the step via env:. Secrets are automatically masked by GitHub — the action only reports whether each value is set or empty.

Inputs

Name	Required	Default	Description
variables	✅	—	Newline or comma-separated list of variable/secret names to check.
fail-on-missing	❌	true	Set to false to report missing variables without failing the workflow.

Outputs

Name	Description
result	"true" if all variables are set, "false" otherwise.
missing-count	Number of missing variables.
missing-variables	Comma-separated list of missing variable names.

Examples

Basic — fail if anything is missing (default)

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: production
    steps:
      - name: Check required variables & secrets
        uses: superhuit-agency/check-env-vars-secrets@v1
        with:
          variables: |
            COMPOSER_GITHUB_TOKEN
            SSH_PRIVATE_KEY
            SSH_HOST
            SSH_PORT
            SSH_USER
            SSH_BASTION_HOST
            SSH_BASTION_PORT
            SSH_BASTION_USER
            WORDPRESS_PATH
            WORDPRESS_URL
            WORDPRESS_THEME_NAME
            NEXT_URL
            NEXT_PATH
            DOCKER_COMPOSE_PATH
        env:
          COMPOSER_GITHUB_TOKEN: ${{ secrets.COMPOSER_GITHUB_TOKEN }}
          SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
          SSH_HOST: ${{ vars.SSH_HOST }}
          SSH_PORT: ${{ vars.SSH_PORT }}
          SSH_USER: ${{ vars.SSH_USER }}
          SSH_BASTION_HOST: ${{ vars.SSH_BASTION_HOST }}
          SSH_BASTION_PORT: ${{ vars.SSH_BASTION_PORT }}
          SSH_BASTION_USER: ${{ vars.SSH_BASTION_USER }}
          WORDPRESS_PATH: ${{ vars.WORDPRESS_PATH }}
          WORDPRESS_URL: ${{ vars.WORDPRESS_URL }}
          WORDPRESS_THEME_NAME: ${{ vars.WORDPRESS_THEME_NAME }}
          NEXT_URL: ${{ vars.NEXT_URL }}
          NEXT_PATH: ${{ vars.NEXT_PATH }}
          DOCKER_COMPOSE_PATH: ${{ vars.DOCKER_COMPOSE_PATH }}

      - name: Deploy
        run: echo "All checks passed, deploying…"

Report only — continue even if something is missing

- name: Check variables (non-blocking)
  id: check
  uses: superhuit-agency/check-env-vars-secrets@v1
  with:
    variables: |
      OPTIONAL_TOKEN
      OPTIONAL_URL
    fail-on-missing: 'false'
  env:
    OPTIONAL_TOKEN: ${{ secrets.OPTIONAL_TOKEN }}
    OPTIONAL_URL: ${{ vars.OPTIONAL_URL }}

- name: Use check result
  run: |
    echo "All set: ${{ steps.check.outputs.result }}"
    echo "Missing: ${{ steps.check.outputs.missing-variables }}"

Comma-separated names (alternative syntax)

- uses: superhuit-agency/check-env-vars-secrets@v1
  with:
    variables: 'DB_HOST,DB_USER,DB_PASSWORD'
  env:
    DB_HOST: ${{ vars.DB_HOST }}
    DB_USER: ${{ vars.DB_USER }}
    DB_PASSWORD: ${{ secrets.DB_PASSWORD }}

How it works

The action is a composite action that runs a Bash script (check.sh). For each name you provide:

1. It looks up the value from the environment (set via env: at the step level).
2. If the value is empty or unset, it emits a ::error:: workflow annotation and increments a counter.
3. After processing all names, it writes result, missing-count, and missing-variables to $GITHUB_OUTPUT.
4. If fail-on-missing is true (default) and any variables are missing, it exits with code 1 to fail the workflow.

Security note: The action never prints variable values. GitHub Actions automatically masks secrets (***) — the output only states whether each name is set or not.

Contributing

Contributions are welcome! Please open an issue or submit a pull request.

License

MIT