Best Practices for Managing and Rotating Secrets in GitHub Repositories

[Prince140903]

Select Topic Area

General

Body

Hi all 👋,

I'm working on a project that involves accessing third-party APIs and cloud services, and I'm currently storing sensitive credentials (API keys, tokens) using GitHub Actions Secrets. I want to ensure that I'm following best practices around secrets management and rotation to avoid accidental leaks or misuse.

Here are a few questions I’d love some input on:

Is there a recommended frequency for rotating secrets stored in GitHub Actions?

What tools or workflows do you use to automate secret rotation or detect stale/unused secrets?

How do you handle secrets in forked PRs securely without exposing sensitive data?

Do any of you integrate tools like HashiCorp Vault, Doppler, or AWS Secrets Manager with GitHub for better control?

Any insights, lessons learned, or pointers to good resources would be appreciated 🙏

Thanks in advance!

[chogalesoham]

🔐 Best Practices for Secrets Management in GitHub
✅ 1. Rotate Secrets Regularly
Recommended: Rotate secrets every 90 days or sooner based on risk.

Use GitHub’s audit log to monitor secret usage and rotation.

🔁 2. Automate Rotation
Tools like:

AWS Secrets Manager

HashiCorp Vault

Doppler

These can automatically rotate and inject secrets into GitHub Actions at runtime via environment variables or CI plugins.

🛑 3. Avoid Secrets in Forked PRs
By default, GitHub does not expose secrets to workflows triggered by forked PRs.

If needed, use pull_request_target with caution and avoid actions that expose secrets (e.g., commenting with secrets or uploading logs).

🔍 4. Detect Leaked Secrets
Enable GitHub Secret Scanning (free for public repos).

Use tools like:

truffleHog

gitleaks

These can scan your history and PRs for exposed secrets.

🧼 5. Keep Secrets Out of Code
Never hardcode secrets in source files.

Use .env files locally and store production secrets in GitHub Actions → Settings → Secrets.

🔄 6. CI/CD Integration with Vaults
Use custom actions or GitHub’s OIDC support to fetch secrets dynamically:

For example, AWS Secrets Manager + GitHub OIDC = no need to store static AWS keys in GitHub.