Manage secrets for actions

Rotate the actions secrets used by deployment workflows in the webapp repo. Update the secret named DEPLOY_KEY with the new RSA key, set the staging key to expire in two weeks, and verify that the deploy job completes successfully when the workflow runs from the ci/deploy branch. Confirm you did not leave the old key accessible to any third-party apps.

Before I rotate secrets for workflows, make the change low-risk: list every workflow and runner that reads DEPLOY_KEY, surface any third-party apps that reference it, and show which branches might still use the old value. Flag secrets that are reused across environments and suggest a safer per-environment naming approach to reduce blast radius.

I replaced DEPLOY_KEY for webapp and now staging deploys immediately fail; production is still fine but the staging lead is upset. I worry I missed a workflow or a self-hosted runner that caches secrets. I cannot tell which workflow or runner is using the old key. What is the most likely place it's referenced and the quickest way to identify and fix the failing workflow without touching production secrets?

Every quarter we rotate secrets and each rotation spawns emergency fixes: forgotten workflows, third-party apps, and cached runners. We burn days for what should be routine security work. I want a repeatable habit to make secret rotation predictable and low-friction. Recommend a playbook: naming conventions, an inventory routine, and a staged rotation procedure that minimizes outage risk.