Secrets expiry #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Secret-expiry guard (ADR-0045; ADR-0021: SHA-pinned, least-privilege). | |
| # Fails on a schedule once a documented Actions secret enters its rotation | |
| # window or lapses. Credential-free: the job reads only the committed | |
| # .github/secrets-expiry.json record and never touches a secret. | |
| name: Secrets expiry | |
| on: | |
| schedule: | |
| # Daily at 06:41 UTC. A rotation window is measured in weeks, so a daily | |
| # failing run is the notification; nothing here blocks a pull request. | |
| - cron: "41 6 * * *" | |
| workflow_dispatch: {} | |
| permissions: {} | |
| concurrency: | |
| group: secrets-expiry | |
| cancel-in-progress: false | |
| jobs: | |
| org-secrets: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| with: | |
| persist-credentials: false | |
| - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 | |
| # Zero-dependency Node script: no `npm ci`, no registry access. | |
| - run: npm run check:secret-expiry |