skills.rest
edri2or
edri2orOFFICIAL
Explore all skills by this author →
GitHub

migrate-pat-secrets-to-terraform

Migrate PyNaCl and REST PUT PAT secrets to Terraform-managed GitHub Actions secrets.

Updated Aug 27, 2026
Search Tags:#secrets#terraform#github-actions#migrate#pat#pynacl
One-click install
npx skills add https://github.com/edri2or/ripo-skills-main --skill migrate-pat-secrets-to-terraform
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: migrate-pat-secrets-to-terraform
Source: https://github.com/edri2or/ripo-skills-main/tree/main/exported-skills/migrate-pat-secrets-to-terraform
Command: npx skills add https://github.com/edri2or/ripo-skills-main --skill migrate-pat-secrets-to-terraform

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Replaces a repository's PyNaCl + classic PAT runtime secret-writing with Terraform github_actions_secret resources fed by an App-token-via-WIF chain. This enables retirement of legacy tokens and safer secret management.

Core Features & Use Cases

  • Detects workflows that write runtime secrets using PyNaCl or REST PUT with a PAT, and flags targets for migration.
  • Maps runtime secrets to Terraform references and rewrites workflows to use an App-token via WIF, preserving access controls.
  • Emits Terraform configurations for github_actions_secret resources and ensures the necessary app-token integration steps.
  • Rewrites the target workflow to adopt the App-token chain while preserving the initial authentication steps.
  • Adds an audit-closure ADR documenting the migration decisions and consequences.

Quick Start

Run the migration on a target repository to replace PyNaCl + REST PUT PAT-based secret writing with Terraform-based github_actions_secret resources.

Frequently Asked Questions about migrate-pat-secrets-to-terraform

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I migrate GitHub Actions secrets from PyNaCl and PAT usage to Terraform?▼

Migrating GitHub Actions secrets involves detecting PyNaCl or REST PUT PAT usage, mapping runtime secrets to Terraform github_actions_secret resources, and rewriting workflows to an App-token-via-WIF chain. This Skill automates that entire migration process.

What is the best way to retire a classic PAT used for writing runtime secrets?▼

Retiring a classic PAT involves replacing its runtime secret-writing mechanism with Terraform-managed github_actions_secret resources fed by an App-token-via-WIF chain. This Skill automates the replacement to enable safer secret management.

How does the App-token-via-WIF chain work for GitHub Actions secret management?▼

The App-token-via-WIF chain replaces classic PATs by using workload identity federation to obtain an App token for managing github_actions_secret resources. Workflows are rewritten to adopt this chain while preserving existing access controls.

Can I use Terraform to manage GitHub Actions secrets in repositories relying on PyNaCl encryption?▼

Yes, you can migrate PyNaCl-based runtime secrets to Terraform. This Skill detects PyNaCl-based workflows, maps them to Terraform github_actions_secret resources, and rewrites the workflows to retire legacy tokens like PUSH_TARGET_TOKEN.

Does migrating secrets to Terraform-managed resources require updating workflow authentication steps?▼

Yes, migrating secrets requires rewriting target workflows to adopt the App-token-via-WIF chain. The Skill rewrites workflows to use the new App-token chain while preserving the initial authentication steps and access controls.

What are the limitations of migrating PAT-based runtime secrets to Terraform github_actions_secret resources?▼

The migration specifically targets repositories relying on PyNaCl and REST PUT PAT usage aiming to retire PUSH_TARGET_TOKEN. Repositories using different secret-writing mechanisms may not be detected or supported by this migration workflow.

Related Skills

Explore More Software Engineering Skills→
AnvinX1AnvinX1

vulnerability-scanner

Scan codebases for dependency risks, secret leakage, and insecure configurations.

Community
Advanced
The13thNodeThe13thNode
3

infrastructure-as-code

Provision AWS resources with Terraform and manage local Docker Compose stacks.

Community
Advanced
hopeoverturehopeoverture
6

workflow-templates/nextjs-ci.yml

Generate GitHub Actions CI/CD workflows for Next.js projects.

Community
Advanced
CenredJunCenredJun

terraform-iac-expert

Manage infrastructure as code with Terraform and OpenTofu across AWS, GCP, and Azure.

Community
Advanced