Add secrets diagnostics workflow for repository health monitoring

[Copilot]

Implements automated diagnostics for repository secrets to proactively identify configuration issues and API access failures.

Implementation

Diagnostic Script (.github/scripts/secrets-diagnostics.cjs)

• Tests 8 secrets via native HTTPS API calls (GitHub REST/GraphQL, Anthropic, OpenAI, Brave, Notion)
• Generates markdown report with status (success/failure/not-set/skipped), API responses, and actionable recommendations
• Zero dependencies, 10s timeout per call, color-coded console output

Workflow (.github/workflows/secrets-diagnostics.yml)

• Triggers: workflow_dispatch + weekly schedule (Mon 9AM UTC)
• Outputs: Step summary + artifact (30d retention)
• Read-only permissions, never fails pipeline

Report Structure

## Summary
- Total Tests: 9
- ✅ Successful: 5
- ❌ Failed: 1
- ⚪ Not Set: 3

## Detailed Results

### GH_AW_GITHUB_TOKEN
#### GitHub REST API
- **Status:** ✅ success
- **Message:** REST API access successful
- **Details:**
  ```json
  {"statusCode": 200, "repoName": "githubnext/gh-aw"}

Recommendations

Failed Tests

• OPENAI_API_KEY - Invalid key (401)

## Secrets Tested

- **GitHub**: `GH_AW_GITHUB_TOKEN`, `GH_AW_GITHUB_MCP_SERVER_TOKEN`, `GH_AW_PROJECT_GITHUB_TOKEN`
- **AI Engines**: `ANTHROPIC_API_KEY`, `OPENAI_API_KEY`, `GH_AW_COPILOT_TOKEN`
- **Integrations**: `BRAVE_API_KEY`, `NOTION_API_TOKEN`

## Extension Pattern

Add new secret tests in three locations:

```javascript
// 1. Test function in secrets-diagnostics.cjs
async function testNewAPI(token) {
  if (!token) return { status: 'not_set', message: 'Token not set' };
  const result = await makeRequest('api.example.com', '/v1/auth', {
    'Authorization': `Bearer ${token}`
  });
  return result.statusCode === 200
    ? { status: 'success', message: 'Authenticated' }
    : { status: 'failure', message: `Status ${result.statusCode}` };
}

// 2. Call in runDiagnostics()
const newResult = await testNewAPI(process.env.NEW_SECRET);
results.push({ secret: 'NEW_SECRET', test: 'API Auth', ...newResult });

// 3. Workflow env
env:
  NEW_SECRET: ${{ secrets.NEW_SECRET }}

Custom agent used: agentic-workflows
GitHub Agentic Workflows (gh-aw) - Create, debug, and upgrade AI-powered workflows with intelligent prompt routing

Original prompt

Create an action workflow (non-agentic) that runs diagnostic tests for each secret used in the repo that generate a diagnostic report about the current support status.

The action should be a JavaScript script that check each known secret and validates that it is properly configured (to some extent).

For example, for GH_AW_GITHUB_TOKEN , test a readonly REST and GraphQL query against the current repo. Report the api status code.

Collect results in a diagnostics.md file that will get uploaded to an artifact and as a step summary's.

Cover all the known secrets including agentic engine secrets.

If the secrets are not set, just mention it and go on.

Custom agent used: agentic-workflows
GitHub Agentic Workflows (gh-aw) - Create, debug, and upgrade AI-powered workflows with intelligent prompt routing

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[pelikhan]

@copilot delete this file

[Copilot]

Done in 37bfc6f