skills.rest
srz-zumix
srz-zumixCOMMUNITY
Explore all skills by this author →
Website𝕏@srz_zumixGitHub

dst-token-secret-migration

Migrate GitHub Actions secrets using --dst-token as a delegated secret name.

Updated Feb 22, 2026
Search Tags:#workflow#migration#secrets#github-actions#secret-management#pat#dst-token
One-click install
npx skills add https://github.com/srz-zumix/gh-secret-kit --skill dst-token-secret-migration
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: dst-token-secret-migration
Source: https://github.com/srz-zumix/gh-secret-kit/tree/main/skills/dst-token-secret-migration
Command: npx skills add https://github.com/srz-zumix/gh-secret-kit --skill dst-token-secret-migration

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill guides operators through migrating GitHub Actions secrets when the destination host requires a delegated access pattern using --dst-token. It explains how to treat --dst-token as a secret name for create/all workflows and as a token value for local checks, ensuring secrets are never exposed in workflows.

Core Features & Use Cases

  • Supports repository, environment, and organization secret migrations using a delegated destination token.
  • Teaches storing the destination PAT as a repository secret on the source repo and referencing it in generated workflows.
  • Provides end-to-end guidance for setting up runners, executing migration steps, and performing checks.

Quick Start

Store the destination PAT as a secret on the source repository and follow the outlined workflow to migrate secrets with --dst-token.

Frequently Asked Questions about dst-token-secret-migration

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I migrate GitHub Actions secrets when I lack destination host credentials?▼

Migrate GitHub Actions secrets by using a delegated access pattern with --dst-token. Store the destination PAT as a repository secret on the source repo, allowing generated workflows to authorize the migration without exposing credentials.

What does --dst-token do during a GitHub Actions secret migration?▼

The --dst-token parameter acts as a secret name for create/all workflows and as a token value for local checks. It enforces proper secret handling by ensuring the destination PAT authorizes the migration safely.

Can I use a destination PAT to migrate repository, environment, and organization secrets?▼

Yes, delegated destination token migration supports repository, environment, and organization secret scenarios. You store the destination PAT as a source repository secret and reference it within generated workflows to authorize the transfer.

How do I set up GitHub Actions runners for delegated secret migration?▼

Set up delegated secret migration by storing the destination PAT as a source repository secret, configuring runner management, and executing the outlined migration steps. Follow the workflow to register secrets and perform local checks.

Why should I store the destination PAT as a repository secret instead of using it directly?▼

Storing the destination PAT as a repository secret ensures secrets are never exposed in workflows. Referencing it in generated workflows enforces proper secret handling and safely authorizes the migration.

What are the limitations of migrating GitHub Actions secrets with --dst-token?▼

The --dst-token migration requires the operator to lack destination host credentials and rely on a repository secret for authorization. You must enforce proper runner management, secret registration, and workflow setup to avoid exposure.

Related Skills

Explore More Software Engineering Skills→
srz-zumixsrz-zumix

migrate-secrets-without-org-owner

Migrate GitHub Actions secrets across repositories using repo-level runners.

Community
Advanced
matt-fell-aimatt-fell-ai
1

Vault

Encrypt secrets with a local keychain and master identity token.

Community
Basic
YangTaeyoungYangTaeyoung

infrastructure-layer

Validate Go infrastructure layers using Echo, GORM, and Uber fx.

Community
Advanced
srz-zumixsrz-zumix

cross-host-secret-migration

Migrate GitHub Actions secrets, variables, deploy keys, and environments between hosts using gh-secret-kit.

Community
Advanced