EnvMark – Git-Based .env Management

TL;DR

TL;DR: EnvMark replaces ad-hoc .env sharing with a Git-backed workflow—push to branches, pull on any machine, zero config needed.

Source and Accuracy Notes

⚠️ This section is MANDATORY. All links must be verified from actual source, not guessed.

• Project page: envmark.tech ← MUST visit and verify
• Source repository: github.com/Grazulex/envmark ← MUST read README
• License: MIT ← verified from LICENSE file in repo

What Is EnvMark?

EnvMark is a CLI tool that stores .env files in a Git repository instead of relying on Paste links, Slack messages, or scattered local copies. Each environment (dev, staging, prod) maps to a Git branch, giving you version history, diffs, and rollback for free.

The core workflow:

# Push local .env to the dev branch
envmark push dev

# Pull the .env on a new machine
envmark pull dev

It works with any Git hosting—GitHub, GitLab, Bitbucket—and requires no server or third-party account beyond your existing Git repo.

Setup Workflow

Step 1: Install

npm install -g envmark

Requires Node.js 18 or later.

Step 2: Initialize

envmark init -r [email protected]:your-org/env-secrets.git

This creates ~/.envmark/config.json (global config) and .envmark.json (project config). Point it at a private repo that will hold your secrets—make sure that repo is excluded from your main project’s .gitignore.

Step 3: Push your .env

# Push to development environment
envmark push dev

# Push to staging
envmark push staging

# Push to production
envmark push prod

Each push creates or updates the corresponding branch in your secrets repo.

Step 4: Pull on Another Machine

git clone your-project
cd your-project
envmark init
envmark pull dev

Step 5: Diff and Rollback

# Compare two environments
envmark diff dev prod

# Show current configuration
envmark status

Deeper Analysis

Why this matters: Sharing .env files across a team is usually done via Slack, Google Drive, or worse—email. None of that gives you a history of changes, and accidentally committing secrets to a public repo is a common disaster.

EnvMark’s branch-per-environment model makes it natural to review what changed before pulling. A git log on the prod branch tells you exactly when a secret was updated and by whom.

Trade-offs:

• Your secrets repo must be private and access-controlled
• If your Git host goes down, you cannot pull secrets (mitigate by keeping a local backup of .env)
• The CLI requires every user to have Git configured with SSH keys for the secrets repo
• EnvMark stores secrets in plain text in Git—anyone with read access to the repo can see them. For high-security environments, consider encrypting .env before pushing (e.g. with sops or git-crypt)

Practical Evaluation Checklist

• [ ] Install via npm install -g envmark on a clean machine
• [ ] Run envmark init with a test private repo
• [ ] Create a .env file and push to dev
• [ ] Clone to a different directory and pull
• [ ] Verify the pulled file matches the original
• [ ] Run envmark diff dev staging to compare two environments
• [ ] Check that the secrets repo branch isolation matches expectations

Security Notes

EnvMark stores secrets in plain text in Git. This is a fundamental limitation—if your secrets repo is public or an unauthorized person gains access, all secrets are exposed.

Recommendations:

• Keep the secrets repo private with strict access control
• Never use the same repo for source code and secrets
• Consider pre-commit encryption (e.g. sops) if your team handles sensitive credentials
• Add the secrets repo to your main project’s .gitignore to avoid double-committing .env

FAQ

Q: Does EnvMark work with GitLab or Bitbucket? A: Yes. It uses Git under the hood, so any Git hosting works. The envmark init -r flag accepts any Git URL (SSH or HTTPS).

Q: Can I use one repo for multiple projects? A: Yes. One repo, multiple project subdirectories. Each project gets its own .envmark.json config that points to the shared secrets repo.

Q: What happens if I push to a branch that has newer commits? A: Git will refuse the push and warn you about divergence. You need to pull, merge, then push—or force-push with git push --force if you are sure you want to overwrite.

Q: Is there a size limit on the .env file? A: No explicit limit, but Git is not designed for large binary files. Keep your .env files to text secrets (API keys, database URLs, etc.) under a few megabytes total.

Conclusion

EnvMark is a lightweight, zero-infrastructure solution for teams that want Git’s history and branch isolation for their environment variables. It is not a secrets vault—it stores plain text in Git—so it fits best for teams already comfortable with Git access controls and willing to add encryption for sensitive production credentials.

If your main pain point is “where is the latest .env for production?” and you want something simpler than a full secrets manager, EnvMark is worth a look.

Source: github.com/Grazulex/envmark — MIT licensed, version 1.1.0 verified.