secret-exec — run a command with your token, never on disk

madtea secret-exec runs a child command with your stored Forgejo/Gitea token injected into its environment. The token is fetched from wherever madtea already keeps it — your OS keychain, pass, the MADTEA_TOKEN environment variable, or git config — and placed into the child process’s environment under the variable name(s) you choose. It is never printed, logged, written to a file, or passed as a command-line argument.

The use case: a deploy script, goreleaser, curl, or some other tool needs the same token madtea uses, but you don’t want to copy it into a shell variable, an .env file, or your shell history to get it there.

Synopsis

madtea secret-exec <VAR[,VAR...]> -- <command> [args...]

• <VAR[,VAR...]> — one or more environment-variable names, comma-separated. Each must be a valid POSIX identifier (^[A-Za-z_][A-Za-z0-9_]*$); names with =, spaces, hyphens, or a leading digit are rejected before anything runs. The same token value is injected under every name you list.
• -- — separates madtea’s arguments from the child command. It is recommended but optional; if you omit it, the first argument is taken as the variable list and the rest as the command.
• <command> [args...] — the program to run and its arguments. Its stdin, stdout, and stderr are wired straight through to your terminal, and its exit code becomes madtea’s exit code.

Examples

# Give goreleaser the token as GITEA_TOKEN, only for that one process:
madtea secret-exec GITEA_TOKEN -- goreleaser release --clean

# Some tools read a differently-named variable — inject under several at once:
madtea secret-exec GITEA_TOKEN,FORGEJO_TOKEN -- ./deploy.sh

# Any command works; the token reaches only this curl, not your history:
madtea secret-exec TOKEN -- curl -H "Authorization: token $TOKEN" https://forge/api/v1/...

What it guarantees (and what it does not)

What secret-exec does:

• Never on disk. The token is read from the configured backend straight into memory and handed to the child via its environment block. madtea writes no temp file.
• Never in argv. The token is not a command-line argument of either madtea or the child, so it does not appear in ps output or anything that inspects a process’s argument vector.
• Never in your shell history. Because you name a variable rather than pasting the secret, the literal token never appears on the command line your shell records.
• Never printed or logged. madtea does not echo the token, and the command produces no output that contains it.

What it does not hide — and cannot:

• The child process and its descendants can read the token. That is the entire point: the value lives in the child’s environment, so the child and everything it spawns can see it (on Linux, e.g. via /proc/<pid>/environ). Only run secret-exec with a command you trust with your token.

When to use it

Reach for secret-exec whenever a non-madtea tool needs the forge token: release tooling, deploy scripts, ad-hoc curl calls, or any CLI that reads an environment variable for its credentials. It keeps the single source of truth in madtea’s secure backend instead of scattering copies of the token across .env files, exported shell variables, and CI logs.

For madtea’s own git operations (clone / push / pull / fetch) you don’t need this — those route the token through GIT_ASKPASS automatically. See credential safety for the storage backends and the broader threat model.

Reference

The generated command reference entry is in CLI workflows.