A 60-line Go tool for validating .env files

Every project that grows beyond a weekend eventually ships a deploy that silently misses an env var. The service boots, half a feature stops working, and someone notices a day later. We got tired of it and wrote a 60-line tool that we now run as the first step of every CI job.

The shape of it

The idea is boring on purpose. You commit a schema file — env.schema — that lists what each environment expects. The tool reads it, reads the actual .env, and tells you what’s missing, what’s extra, and what looks wrong:

$ envcheck --env production .env
✗ DATABASE_URL          missing
✗ ANTHROPIC_API_KEY     missing
! SENTRY_DSN            present but empty
✓ PORT                  ok
✓ LOG_LEVEL             ok

Exit code 1 on any ✗, 0 otherwise. CI fails before deploy, not after.

The schema

A schema entry is one line. Required vars get a !, optional vars get a ?, and you can scope to environments:

! DATABASE_URL          production,staging
! ANTHROPIC_API_KEY     production,staging
? SENTRY_DSN            production
! PORT                  *
! LOG_LEVEL             *

That’s the whole spec. No types, no regex validation, no JSON Schema. We tried richer schemas twice and abandoned them both times — every team already has some validation for the values themselves; what they didn’t have was a clear inventory of which keys must exist where.

What we didn’t build

Auto-fix, .env templating, secret rotation, anything cloud-aware. The tool does one thing: tell you which env vars are missing for a given environment before the deploy goes out. We’ll know it’s grown too big the day it starts needing a config file of its own.