💡 Scoped Secrets Readiness Audit and Migration Standard

[github-actions[bot]]

Summary

Prepare the org for GitHub's upcoming Scoped Secrets feature (on the 2026 Actions Security Roadmap, 3–6 months to GA) by auditing every workflow-secret binding across all repos and documenting the minimum required scope for each. This transitions the org from the current secrets: inherit pattern — which GitHub explicitly calls out as an overexposure antipattern — to fine-grained credential scoping bound to specific repositories, branches, environments, and workflow identities.

Market Signal

GitHub's 2026 Actions Security Roadmap explicitly identifies secrets overexposure in reusable workflows as a key problem:

• Scoped Secrets will allow binding credentials to repositories, branches, environments, workflow identities, and trusted reusable workflows
• Secret management separated from write access — repository write access will no longer grant secret management permissions, delegated instead to custom roles
• Reusable workflow inheritance change — secrets will no longer automatically inherit; only explicitly scoped secrets will be accessible
• Timeline: public preview 3–6 months, GA 6 months from the February 2026 roadmap announcement

This represents a fundamental shift in how GitHub Actions handles credentials in reusable workflows.

User Signal

The org's reusable workflow architecture relies heavily on secrets: inherit:

• claude-code-reusable.yml — passes CLAUDE_CODE_OAUTH_TOKEN
• agent-shield — passes workflow tokens
• dependabot-automerge — passes app tokens
• feature-ideation — passes GH_TOKEN
• dev-lead — passes multiple secrets

Issue #294 (Agent Credential Isolation Standard) identifies the need for better credential scoping but lacks the platform-native migration path that scoped secrets provides. The current pattern gives every reusable workflow access to every secret the caller has, violating least-privilege.

Technical Opportunity

The org already maintains CI standards (ci-standards.md) and workflow templates (standards/workflows/). A scoped-secrets migration standard fits naturally into this framework. The audit can be automated:

# Find all secrets: inherit usage across the fleet
grep -r "secrets: inherit" .github/workflows/ standards/workflows/

Each workflow-secret binding can be documented with its minimum required scope, creating a migration-readiness map that's actionable the moment scoped secrets reach GA.

Assessment

Dimension	Score	Rationale
Feasibility	high	Audit and documentation exercise; no code changes until feature GAs
Impact	high	Secrets are the #1 CI attack surface; touches every reusable workflow in the org
Urgency	med	Feature not yet GA, but planning now prevents a disruptive scramble later and reveals current security gaps

Adversarial Review

Strongest objection: The feature isn't GA yet. Planning for something that might change is premature.

Rebuttal: GitHub's roadmap is public and the direction is clear — secrets: inherit is being deprecated as a security antipattern. The audit itself reveals current security gaps regardless of when the feature ships. The org's heavy reliance on reusable workflows with inherited secrets makes this migration particularly impactful. Organizations that prepare proactively will have smoother transitions; those that wait will face a scramble when enforcement arrives.

Suggested Next Step

Run a fleet-wide audit of secrets: inherit usage and document every workflow-secret binding with its minimum required scope. Output: a migration-readiness report and a standards/scoped-secrets.md policy document.