# Secrets Management

> GitHub secrets and environment variables for MCP servers and CI/CD workflows Use when this capability is needed.

- Skill: `tomevault-io/secrets-management` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add tomevault-io/secrets-management`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/secrets-management/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: tomevault-io (https://skillmd.com/u/tomevault-io)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/tomevault-io/secrets-management

---


# Secrets Management

## Purpose

Secure management of GitHub secrets for MCP servers and CI/CD workflows.

## GitHub Secrets Configuration

### Repository Secrets
```yaml
# Settings → Secrets and variables → Actions → Repository secrets

COPILOT_MCP_GITHUB_PERSONAL_ACCESS_TOKEN
  - Description: GitHub PAT for MCP server with Insiders API
  - Scopes: repo, read:org, read:user
  - Expiration: 90 days (renewal required)
```

### Environment Secrets
```yaml
# Settings → Environments → copilot → Environment secrets

COPILOT_MCP_GITHUB_PERSONAL_ACCESS_TOKEN
  - Description: GitHub PAT for Copilot environment
  - Injected via: COPILOT_AGENT_INJECTED_SECRET_NAMES
```

## Secret Usage in Workflows

### MCP Configuration
```json
// .github/copilot-mcp.json
{
  "mcpServers": {
    "github": {
      "env": {
        "GITHUB_TOKEN": "${{ secrets.COPILOT_MCP_GITHUB_PERSONAL_ACCESS_TOKEN }}",
        "GITHUB_PERSONAL_ACCESS_TOKEN": "${{ secrets.COPILOT_MCP_GITHUB_PERSONAL_ACCESS_TOKEN }}"
      }
    }
  }
}
```

### Workflow Usage
```yaml
# .github/workflows/copilot-setup-steps.yml
env:
  GITHUB_TOKEN: ${{ secrets.COPILOT_MCP_GITHUB_PERSONAL_ACCESS_TOKEN }}
  GITHUB_PERSONAL_ACCESS_TOKEN: ${{ secrets.COPILOT_MCP_GITHUB_PERSONAL_ACCESS_TOKEN }}
```

## Security Best Practices

- ✅ Never commit secrets to repository
- ✅ Use GitHub secret scanning
- ✅ Rotate secrets every 90 days
- ✅ Minimal scope (least privilege)
- ✅ Environment-specific secrets
- ✅ Audit secret access logs

## References

- **GitHub Secrets**: https://docs.github.com/en/actions/security-guides/encrypted-secrets
- **Secret Scanning**: https://docs.github.com/en/code-security/secret-scanning
- **SECURITY.md**: Security policy

---
> Converted and distributed by [TomeVault](https://tomevault.io/claim/hack23) — claim your Tome and manage your conversions.
<!-- tomevault:4.0:skill_md:2026-04-13 -->