[olivermeyer]

Why?
Security Day asks each repository to audit its GitHub Actions secrets and to delete every secret that it can do without. The BetterStack monitors and the Claude Code workflows are retired, and the SDK is deprecated with no further releases planned, so their secrets can go. CI passes two device client IDs that it never reads, and stores the public Ketryx project ID as a secret.

How?
This PR (one commit per concern) removes the BetterStack heartbeat steps and uptime badge, all four Claude Code workflows (and their labels), the Slack release announcement, the Sentry release step and the Sentry cron check-ins of the scheduled tests, stops passing the device client IDs, and moves the Ketryx project ID to a repository variable. A later step still fails the daily job when tests fail, so the removed check-in step changes no job result.

---

Device client IDs and the Ketryx variable

CI does not need AIGNOSTICS_CLIENT_ID_DEVICE. get_token uses the refresh token when one is set, and _do_access_token_from_refresh_token sends client_id_interactive from src/aignostics/platform/_constants.py. Only _perform_device_flow reads the device client ID, and CI always has a refresh token. The tests that read client_id_device set their own value. The Auth0 logs of the production CI user show only the interactive client.

KETRYX_PROJECT is set as a repository variable (2026-11-13). Its value is the Ketryx project "Python SDK", which is connected to this repository.

Audit report

Scope of the search: all files in .github/ (24 workflows after this PR, 1 composite action, CLAUDE.md). The search found no secrets: inherit, no toJSON(secrets) and no cross-repository reusable workflow. All referenced names exist at some level, so no row is "not set". CODECOV_TOKEN, SONAR_TOKEN, RELEASE_BOT_APP_ID and RELEASE_BOT_PRIVATE_KEY come from the organization, and the repository has no copy of them.

Secret	Set on	Verdict	Evidence	Action
AIGNOSTICS_CLIENT_ID_DEVICE_STAGING	2025-10-05	unused after this PR	written into the .env of _test.yml and the scheduled tests, but only the device flow reads it, and CI does not run it. The .env lines are removed in this PR	delete after merge
AIGNOSTICS_CLIENT_ID_DEVICE_PRODUCTION	2025-10-05	unused after this PR	same as staging	delete after merge
AIGNOSTICS_REFRESH_TOKEN_STAGING	2025-10-14	keep	.env of _test.yml and the scheduled tests	rotate (set before 2026-09-17), bind to a dedicated test user
AIGNOSTICS_REFRESH_TOKEN_PRODUCTION	2025-12-03	keep	.env of the scheduled production tests	rotate (set before 2026-09-17), bind to a dedicated test user
ANTHROPIC_API_KEY	2026-06-09	unused after this PR	only the four Claude Code workflows read it, and this PR deletes them. Not a shadow: the org secret is not visible to this public repository	delete after merge
BETTERSTACK_AUDIT_HEARTBEAT_URL	2026-01-08	unused after this PR	heartbeat step of _scheduled-audit.yml, removed in this PR	delete after merge
BETTERSTACK_HEARTBEAT_URL_STAGING	2025-12-02	unused after this PR	heartbeat of _scheduled-test-hourly.yml, removed in this PR	delete after merge
BETTERSTACK_HEARTBEAT_URL_PRODUCTION	2025-11-24	unused after this PR	heartbeat of _scheduled-test-hourly.yml, removed in this PR	delete after merge
BETTERSTACK_HEARTBEAT_URL_FLOWS_STAGING	2025-11-22	unused after this PR	heartbeat of _scheduled-test-daily.yml, removed in this PR	delete after merge
BETTERSTACK_HEARTBEAT_URL_FLOWS_PRODUCTION	2025-11-07	unused after this PR	heartbeat of _scheduled-test-daily.yml, removed in this PR	delete after merge
KETRYX_API_KEY	2026-09-25	keep	_ketryx_report_and_check.yml	none
KETRYX_PROJECT	2025-07-17	non-secret config	project ID, also in CLAUDE.md	moved to a variable in this PR, delete after merge
SENTRY_AUTH_TOKEN	2025-11-01	unused after this PR	Sentry release step in _package-publish.yml, removed in this PR	delete after merge
SENTRY_DSN	2025-11-01	unused after this PR	.env of the tests (sample rates 0, so no events) and the Sentry cron check-ins of the scheduled tests, both removed in this PR	delete after merge
SLACK_CHANNEL_ID_RELEASE_ANNOUNCEMENT	2025-08-12	unused after this PR	Slack release announcement in _package-publish.yml, removed in this PR	delete after merge
SLACK_WEBHOOK_URL_RELEASE_ANNOUNCEMENT	2025-08-09	unused after this PR	Slack release announcement in _package-publish.yml, removed in this PR	delete after merge
UV_PUBLISH_TOKEN	2026-10-06	publish token	uv publish in _package-publish.yml	keep: trusted publishing is out of scope for this PR
AIGNOSTICS_CLIENT_ID_DEVICE_STAGING (Dependabot)	2025-10-05	unused	no .github/dependabot.yml, Dependabot security updates are off, last Dependabot PR on 2026-06-17. Renovate opens the dependency PRs, and those PRs read the Actions secrets	delete
AIGNOSTICS_CLIENT_ID_DEVICE_PRODUCTION (Dependabot)	2025-10-05	unused	same	delete
AIGNOSTICS_REFRESH_TOKEN_STAGING (Dependabot)	2025-10-14	unused	same	delete
AIGNOSTICS_REFRESH_TOKEN_PRODUCTION (Dependabot)	2025-10-17	unused	same	delete
ANTHROPIC_API_KEY (Dependabot)	2025-12-03	unused	same	delete

Delete now: the Dependabot copies (--app dependabot). GitHub keeps Dependabot secrets apart from Actions secrets. Only workflows that Dependabot starts can read them, and this repository gets no Dependabot PRs any more. CI reads the Actions copies, which stay:

gh secret delete AIGNOSTICS_CLIENT_ID_DEVICE_STAGING --repo aignostics/python-sdk --app dependabot
gh secret delete AIGNOSTICS_CLIENT_ID_DEVICE_PRODUCTION --repo aignostics/python-sdk --app dependabot
gh secret delete AIGNOSTICS_REFRESH_TOKEN_STAGING --repo aignostics/python-sdk --app dependabot
gh secret delete AIGNOSTICS_REFRESH_TOKEN_PRODUCTION --repo aignostics/python-sdk --app dependabot
gh secret delete ANTHROPIC_API_KEY --repo aignostics/python-sdk --app dependabot

Delete after this PR is merged and the scheduled jobs and the next CI run are green: the Actions copies and variables, grouped by commit:

# ci: remove Claude Code workflows
gh secret delete ANTHROPIC_API_KEY --repo aignostics/python-sdk

# ci: remove BetterStack heartbeats and badge
gh secret delete BETTERSTACK_AUDIT_HEARTBEAT_URL --repo aignostics/python-sdk
gh secret delete BETTERSTACK_HEARTBEAT_URL_STAGING --repo aignostics/python-sdk
gh secret delete BETTERSTACK_HEARTBEAT_URL_PRODUCTION --repo aignostics/python-sdk
gh secret delete BETTERSTACK_HEARTBEAT_URL_FLOWS_STAGING --repo aignostics/python-sdk
gh secret delete BETTERSTACK_HEARTBEAT_URL_FLOWS_PRODUCTION --repo aignostics/python-sdk

# ci: remove Sentry cron monitor check-ins
gh secret delete SENTRY_DSN --repo aignostics/python-sdk

# ci: remove Sentry release step
gh secret delete SENTRY_AUTH_TOKEN --repo aignostics/python-sdk
gh variable delete SENTRY_ORG --repo aignostics/python-sdk
gh variable delete SENTRY_PROJECT --repo aignostics/python-sdk

# ci: remove Slack release announcement
gh secret delete SLACK_WEBHOOK_URL_RELEASE_ANNOUNCEMENT --repo aignostics/python-sdk
gh secret delete SLACK_CHANNEL_ID_RELEASE_ANNOUNCEMENT --repo aignostics/python-sdk
gh variable delete SLACK_CHANNEL_ID_RELEASE_ANNOUNCEMENT --repo aignostics/python-sdk

# ci: drop device client IDs, use Ketryx var
gh secret delete AIGNOSTICS_CLIENT_ID_DEVICE_STAGING --repo aignostics/python-sdk
gh secret delete AIGNOSTICS_CLIENT_ID_DEVICE_PRODUCTION --repo aignostics/python-sdk
gh variable delete AIGNOSTICS_CLIENT_ID_DEVICE_STAGING --repo aignostics/python-sdk
gh variable delete AIGNOSTICS_CLIENT_ID_DEVICE_PRODUCTION --repo aignostics/python-sdk
gh secret delete KETRYX_PROJECT --repo aignostics/python-sdk

Notes

• After this PR, no external monitor watches the scheduled tests. A failed scheduled run shows only in GitHub Actions.
• The commit "ci: remove Sentry cron monitor check-ins" adds # pragma: allowlist secret to the two Trivy SHA-256 lines in _install_dev_tools.bash. The detect-secrets hook flags these checksums as hex strings when a commit changes that file.

Security Day rows

• "Delete repo secrets that shadow org secrets" (ANTHROPIC_API_KEY): Done after the delete commands. No WIF rule is necessary, because the workflows that need the key are gone.
• "Switch package publishing to trusted publishing (OIDC)": not in this PR.
• "Review and prune remaining repo secrets": Done after the delete commands, with the rotation of the two kept refresh tokens that are older than 2026-09-17, or a date in "Planned for".

🤖 Generated with Claude Code

[ox-security]

OX Security reviewed this pull request — nothing to fix.

✔ No issues found

Branch chore/audit-github-secrets → main

View scan in OX Security →

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.
see 17 files with indirect coverage changes

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud