secret-rotation-patterns

Automate GitHub Actions secret rotation with scheduled workflows and revocation checks.

3|3|Updated Jan 4, 2026

Search Tags:#automation #github actions #secrets management #zero-downtime #secret rotation #dual-secret

Ready to run

npx skills add https://github.com/adaptive-enforcement-lab/claude-skills --skill secret-rotation-patterns

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: secret-rotation-patterns
Source: https://github.com/adaptive-enforcement-lab/claude-skills/tree/main/plugins/secure/skills/secret-rotation-patterns
Command: npx skills add https://github.com/adaptive-enforcement-lab/claude-skills --skill secret-rotation-patterns

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires google-github-actions/auth, gcloud, gh, and includes scripts (resource) components.

What problem does it solve?

Automates GitHub Actions secret rotation to reduce exposure and simplify credential lifecycle management.

Core Features & Use Cases

Automated secret rotation using scheduled workflows and event-driven vault updates.
Dual-secret rotation window to enable zero-downtime transitions and safe key revocation.
Alerts, issue creation, and Slack notifications to ensure teams act before secrets expire or are compromised.

Quick Start

Configure a rotation workflow to automatically rotate a repository secret on a schedule.

Frequently Asked Questions about secret-rotation-patterns

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I automate GitHub Actions secret rotation with zero downtime?▼

Automate GitHub Actions secret rotation using scheduled workflows and a dual-secret rotation window, enabling zero-downtime credential transitions and safe key revocation without disrupting active deployments.

What is a dual-secret rotation window for credentials?▼

A dual-secret rotation window is a zero-downtime technique that maintains both the old and new secrets simultaneously during the transition period, allowing workflows to switch over safely before the compromised secret is revoked.

How do I set up scheduled secret rotation and alerts in GitHub?▼

Set up scheduled workflows to automatically rotate repository secrets and configure Slack or issue-based notifications to alert security teams before credentials expire or are compromised.

Can I immediately revoke a compromised GitHub secret out-of-band?▼

Yes, you can trigger immediate revocation checks and perform out-of-band secret updates using GitHub Secrets Manager to instantly mitigate exposure from leaked credentials.

Do I need the gcloud CLI to rotate secrets in GitHub Actions?▼

Yes, this secret rotation process requires the gcloud CLI, the gh CLI, and the google-github-actions/auth integration to authenticate and manage credentials across repositories and workflows.