ghostenv: Securely inject remote environment var's into your runtime

Stop hardcoding sensitive keys into localenv files or dragging your secrets around on Slack. ghostenv is a lightweight, zero-dependency CLI tool built in Go that safely pulls configuration maps from private GitHub repos and hot-injects them directly into your downstream runtimes.

Hey Hunters! 👋 Like many of you, I grew tired of managing scattered .env files across team machines, accidentally checking secrets into source history, or having to sync configuration values via shared chats. I built ghostenv to solve this securely, natively, and with absolutely zero dependencies. It acts as a lightweight proxy wrapper. It uses your GITHUB_TOKEN to fetch configuration JSON arrays directly from specified folders in private manifest repos, handles base64 decryption in memory, merges them with your local variables, and executes your app. Why Go? It makes the binary incredibly portable, lightweight, and fast. Plus, we couldn't resist throwing in clean, terminal-friendly ANSI output logs to show exactly how many variables are being injected dynamically. It's fully open-source and ready to play with! I’d love to hear your feedback on our flags, structure, or any features you'd like to see next. Happy hunting! 👻

How does it handle repo permissions across a team — does each dev need their own GitHub auth token, or is there a shared service account that actually pulls the secrets?

How does it handle secret rotation if a value changes in the GitHub repo while a long-running process is still using the old one?

How does this handle things like secret rotation or if a teammate accidentally commits something to the same private repo after pulling the config?

How does it handle repo permissions across a team — does each dev need their own GitHub auth token, or is there a shared service account that actually pulls the secrets?

How does it handle secret rotation if a value changes in the GitHub repo while a long-running process is still using the old one?

How does this handle things like secret rotation or if a teammate accidentally commits something to the same private repo after pulling the config?