GitHub Actions Repository Secrets Without Expiration Enforcement

Objective

Keep long-lived cloud access keys stored as GitHub Actions secrets from remaining valid after expiration or rotation, without relying on manual cleanup.

This applies to GitHub Actions on GitHub.com and GitHub Enterprise Server where Actions is enabled. GitHub Actions does not display or enforce an expiration date for encrypted repository, environment, or organization secrets. Environment protection rules can require reviewers before a secret is consumed, but they do not set a credential time-to-live. By contrast, the GITHUB_TOKEN expires when a workflow job finishes.

This matters for repositories that still use static cloud credentials alongside OIDC federation for newer workflows.

Open Questions

• Can GitHub Actions detect that a secret-backed cloud credential has expired and fail the workflow before the cloud provider rejects it?
• Is there a native repository or organization setting to enforce secret expiration or rotation?
• Should static-key workflows be migrated to OIDC before the long-lived secrets are removed?