Skip to main content

Environments And Secrets

X4 uses file-backed env contracts. Docs and templates show key names, not real values.

Templates​

PathPurpose
infra/secrets/x4-poc.env.examplePOC env shape.
infra/secrets/x4-provisioning.env.templateProvisioning env shape.
apps/mastra-orchestrator/.env.exampleMastra app env shape.

GitHub Actions Secrets​

X4Org/Mastra-Agent-Framework is canonical and does not consume a mirror from the deprecated Machenta repository. Documentation publication requires these repository secrets:

SecretRequired access
X4_PAGES_APP_IDGitHub App id for publishing documentation into X4Org/X4Org.github.io.
X4_PAGES_APP_PRIVATE_KEYGitHub App private key for short-lived documentation deploy tokens.

The documentation deployment workflow builds documentation/, uploads documentation/build, mints a short-lived GitHub App token from X4_PAGES_APP_ID and X4_PAGES_APP_PRIVATE_KEY, and publishes the static site into X4Org/X4Org.github.io:x4/. It does not store a PAT or copy any runtime env values into the documentation artifact.

Env Commands​

x4 env doctor
x4 env install-bundle

x4 env doctor validates expected key names without printing values.

x4 env install-bundle can install a local dotenv file as a worker-local env bundle. Use --filter-forbidden when the destination must omit keys that are not allowed on the worker.

Rules​

  • Never commit real env files.
  • Never print secret values in logs or PR comments.
  • Worker-local env bundles should be owned by the expected user/group and have restrictive file modes.
  • Mastra GitHub App private keys should live outside the repo.