If GitHub flagged a webhook that was configured by Gearset to support the Pipelines feature, then Gearset recommends you do not rotate the secret for those specific webhooks.
Rotating the secret will result in your Pipeline being unable to process any future webhook payloads sent by that webhook.
Why it's safe to not rotate the secret for Gearset Pipeline webhooks:
Gearset creates and manages the webhook configuration, including the secret, when a pipeline is configured
Webhook payloads are sent only from GitHub to Gearset
If the secret was included in a header, that header was
Encrypted in transit (with TLS)
Visible only to Gearset, who already have a copy of the secret
Why rotating will cause issues
If you rotate the webhook secret in GitHub, Gearset will no longer be able to verify webhook deliveries.
This will break your pipeline/webhook integration.
How to recover if you did rotate the webhook secret:
Delete the webhook configuration in GitHub
Log in to Gearset and visit the Gearset Pipelines configuration page
Click "Add a webhook" when prompted to recreate it
Note that this will recreate the webhook configuration with the same secret as previously, using Gearset's stored copy. Gearset currently does not support rotating webhook secrets. Contact Gearset support if you need further assistance with this issue.