AWS key exposed on GitHub

At 09:14 a security researcher emails support: a long-lived AWS access key for your production data-pipeline IAM user is sitting in a public GitHub repo your company open-sourced last week. The CloudTrail dashboard shows the key was used 11 minutes ago from an IP geolocated to a region you don't operate in, calling s3:ListBuckets and s3:GetObject. The commit that introduced the key is 6 days old; the repo has 40 stars and 3 forks. You're the on-call engineer. Walk through how you triage and contain this, and what the durable fix and postmortem look like.