Variables & Promotions | Ghostable CLI 3.x | Ghostable Menu Variables & Promotions Write one variable ------------------ In an interactive terminal, `var push` can prompt securely for a value. In scripts or non-interactive sessions, Ghostable requires `--file` so the value does not appear in shell history. Update one variable Copy ``` $ ghostable var push --env staging --key STRIPE_SECRET_KEY --file .env.staging --reason "Rotate sandbox credential" ``` The file is parsed locally and only the selected key is encrypted and written. Read one variable ----------------- Write a selected variable to an env file without printing it: Pull one key Copy ``` $ ghostable var pull --env default --key APP_KEY --file .env ``` Passing `--show-values` prints the plaintext value to stdout. Production-like environments require user-presence confirmation before either path can expose the value. Promote between environments ---------------------------- Promotion is explicit about source, destination, key, mode, and reason: Promote configuration Copy ``` $ ghostable var promote --from staging --to production --key FEATURE_API_URL --reason "Release new API endpoint" $ ghostable var promote --from staging --to production --key STRIPE_SECRET_KEY --mode key-only --reason "Reserve production key layout" ``` The default `value` mode copies the value and variable flags. `key-only` adds the key to the destination layout without copying a secret across environment boundaries. Delete and history ------------------ Variable lifecycle Copy ``` $ ghostable var history --env production --key LEGACY_API_TOKEN $ ghostable var delete --env production --key LEGACY_API_TOKEN --reason "Integration retired" ``` Deletion is signed and reviewable. Use `--assume-yes` only in a script that has already confirmed its target. Encrypted context ----------------- Variable context is an encrypted note for information that should travel with a key but should not be visible as repository metadata. Encrypted note Copy ``` $ ghostable var context --env production --key STRIPE_SECRET_KEY --note "Stored in the platform security vault; contact the payments owner for rotation." ``` Annotations and status ---------------------- Annotations are signed, plaintext, typed metadata. Supported values are string, number, and boolean: Key annotations Copy ``` $ ghostable var annotation set --env production --key APP_KEY --name owner --string platform $ ghostable var annotation set --env production --key APP_KEY --name rotation_days --number 90 $ ghostable var annotation set --env production --key APP_KEY --name deploy.managed --bool true $ ghostable var annotation list --env production --key APP_KEY ``` Annotations must never contain secrets. Advanced status commands `var enable`, `var disable`, and `var status` control whether a stored key is emitted as active or commented in generated env files. On this page [ ![Ghostable](https://ghostable.dev/images/logo-dark.svg) ![Ghostable](https://ghostable.dev/images/logo-light.svg) ](https://ghostable.dev) CLI 3.x [ CLI 3.x ](https://ghostable.dev/docs/3.x) [ Desktop ](https://ghostable.dev/docs/desktop) CLI 3.x introduction Documentation local first no login encrypted repository plaintext hosted service Installation Documentation brew homebrew npm npx linux windows PATH version update Start a new project Getting Started setup seed dotenv owner initialize Adopt an existing project Getting Started existing env import authoritative source adopt Onboard a team member Getting Started join request approve roles offboarding pull request Repository and storage Core Concepts .ghostable git conflict merge worktree private identity metadata Environments Core Concepts protected production preview staging push sync pull replace run mask-output Variables and promotions Core Concepts var promote copy context annotation key Access and devices Core Concepts identity reader writer grantor owner revoke rotate leave delete Daily development workflow Workflows pull diff validate review clean daily Review and secret scanning Workflows scan sarif github suppress secrets drift Hygiene and rotation Workflows rotation stale unused suppression environment key Automation credentials Automation & CI GHOSTABLE\_CI\_TOKEN ci deploy credential powershell revoke replace Continuous integration Automation & CI GitHub Actions fork pull request JSON stdout stderr exit codes mask-output Deployments Automation & CI Forge Vapor Cloud provider CLI dry-run preserve remote keys temporary files Validation Reference schema required nullable regex min max different\_from Command reference Reference --help --json NO\_COLOR flags aliases exit code automation Configuration Reference ghostable.yaml activity mode auditEnvironments scan ignores deployTarget dotenv syntax Security Reference cryptography XChaCha20 Poly1305 HKDF user presence threat model Backups & Offline Reference recovery offline restore clone key identity Agent integration Reference AGENTS.md capabilities allowlist coding agent Troubleshooting Reference no project found revoked identity stale policy user presence invalid CI token provider CLI git conflict diagnostics Ghostable Desktop overview Desktop Installation Desktop Projects and setup Desktop Interface tour Desktop Environments and variables Desktop Local environment files Desktop Validation and review Desktop Activity Desktop Access and automation Desktop Project settings Desktop Application settings Desktop Licensing and updates Desktop Security and storage Desktop Troubleshooting Desktop No results found