Creating secret.yml for github-well-architected

[vault-chatops]

This pull request was automatically generated from vault-chatops.
It contains the secrets.yml file for github-well-architected in production.

More info about this file can be found here

Please review these files and add missing information if possible.

These are the most important keys in the secrets.yml file:

key

This specifies the key in vault if it's not the same as the key for this secret

type

The type of secret. This is used to determine how the secret is used in the application.
Some secrets are just configuration. In that case the type is config and the keys owner, playbook and externally_usable can be left out.
For values like usernames that are used to authenticate, but are not a secret, the type credentials should be used.
A list of available types can be found here

owner

Which team owns the usage of the secret, not the central management service. If you are part of the sae-ps team, and the secret is a database credential your team uses, then you put in @github/sae-ps

playbook

Is there a playbook for rotating this secret? If so, please provide a link to it.

externally_usable

If this secret is leaked can it be used without GitHub network access? (like a GitHub PAT)

kind

This should probably be set to latest_at_deployment_start.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[Copilot]

Pull request overview

Adds a production secrets.yml manifest for the github-well-architected service so Moda/Vault-backed secret metadata is available for deployments and auditing.

Changes:

• Introduces config/moda/secrets/production/secrets.yml with secret metadata entries.
• Defines production entries for Copilot-related URLs and an HMAC key (owner, type, kind, etc.).

Comments suppressed due to low confidence (1)

config/moda/secrets/production/secrets.yml:23

• playbook: is specified without a value (YAML null). To keep the schema consistent with other environments (e.g., staging uses playbook: ''), set this to an empty string or omit the key when there is no playbook.

    type: config
    owner: "@github/customer-success-engineering"
    playbook:
    externally_usable: false
    kind: latest_at_deployment_start

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.