env

A config reads the environment — {{ env.X }} in a template, match: { env: … } on a target — and nothing told you which. This does.

$ bedouin env
Variables this config reads:

  BEDOUIN_PROFILE  set      targets.work   (a target; unset just means it will not match)
  GIT_SIGNING_KEY  not set  vars.signing_key
  ZELLIJ_VERSION   not set  packages.zellij   (has a default)

2 of 3 unset.
1 of those has no default and will fail to resolve.

Names and set-or-not, never values — the same rule as bedouin facts, for the same reason: this output ends up in bug reports.

The scan reaches inside the files a files: entry points at, not just the YAML. A {{ env.GIT_USER_NAME }} that lives in templates/gitconfig.j2 is read at render time, so it is listed here — and, just as importantly, frozen into a saved plan. It is also only a reference inside {{ … }} or {% … %}: an rc file named 40-direnv.zsh contains the letters env. and is not a variable.

The last column matters. A variable behind | default(…) cannot fail. One read by a match: cannot fail either — the target just does not match. A bare {{ env.X }} with nothing set is a resolve-time failure waiting to happen, and plan warns about exactly those.

.env.bedouin

$ bedouin env --write
Wrote ./.env.bedouin
Bedouin reads it before resolving facts, so what you put there takes effect.
Added it to ./.gitignore

It writes a commented file listing every variable, with the ones already set left commented out so filling in a blank cannot silently shadow something that is working.

It is read, not just written

Bedouin loads .env.bedouin from beside your config before facts resolve, so what you put there reaches {{ env.NAME }} and match:. A file a tool writes and never reads is a trap — you fill it in, nothing consumes it, and the confusion is silent.

Your shell wins over the file: what you exported for this command is more specific than what the file says in general.

$ GIT_SIGNING_KEY=FROMSHELL bedouin apply    # beats the file

Not for real secrets

It holds values in a file beside your config, and those values reach the plan artifact (at mode 0600) like any other referenced variable. --write adds it to .gitignore and warns if it is group- or world-readable, but that is not the same as a secret manager.

For real secrets, keep doing what you are doing: read them in your shell. A drop-in that pulls op:// references at login stays the better pattern.

bedouin env deliberately runs without resolving the config — a config that will not resolve is usually exactly the one you need this for.