Delete the secret, don't rotate it

GitGuardian found 64% of the valid secrets they reported to owners in 2022 were still working this January, and that 59% of compromised machines in their incident data were CI/CD runners. Rotation is losing. Azure DevOps has also put a date in the calendar: the old issuer for workload identity service connections retires on 1 July 2027. What to convert your service connections to, how to do the whole project in one pass, and the query that finds every secret you are still holding.