envsubst Command Reference: Variable Substitution in CI

envsubst replaces shell-style variable references in text with their values.

envsubst (from GNU gettext) reads stdin, substitutes references to environment variables, and writes the result to stdout. In CI it renders config files and manifests from a template plus the job environment.

Common flags and usage

envsubst < template > output: substitute every set variable
envsubst '$VAR1 $VAR2' < template: restrict to a named list
Only ${VAR} and $VAR forms are expanded; no logic or defaults
Unset variables expand to an empty string
Pair with a heredoc or a checked-in template file

Example

shell

export DATABASE_URL APP_ENV
envsubst '${DATABASE_URL} ${APP_ENV}' < config.tmpl > config.yaml

In CI

Pass an explicit SHELL-FORMAT list so envsubst only replaces the variables you intend and leaves other ${...} tokens (for example a downstream tool placeholder) untouched. Variables must be exported to be visible. envsubst has no defaults or conditionals, so for richer templating reach for yq or a real template engine.

Key takeaways

envsubst expands $VAR and ${VAR} in text from the environment.
A SHELL-FORMAT list limits which variables are replaced.
It has no defaults or logic, so keep templates simple.