[daily secrets] Daily Secrets Analysis Report - 2026-09-01

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-09-01
Workflow Files Analyzed: 297
Run: 33539002871

📊 Executive Summary

• Total Secret References: 10,727 (secrets.*)
• GitHub Token References: 2,210 (github.token)
• Unique Secret Types: 39
• Job-Level Usage: 0 (0%)
• Step-Level Usage: 4,909 (100%)

🛡️ Security Posture

✅ Redaction System: 297/297 workflows have redaction steps (100% coverage)
✅ Token Cascades: 1,005 instances of fallback chains (GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN)
✅ Permission Blocks: 297 explicit permission definitions (1 per workflow, 100% coverage)
✅ No template injection: TestCompiledLockFiles_NoGitHubEventExpressionsInRunScripts passed — no direct github.event.* interpolation in run: scripts
✅ No secret exposure in outputs: TestCompiledLockFiles_NoSecretsInOutputs passed — no secrets found in job or workflow_call outputs

🎯 Key Findings

1. Consistent secret hygiene: Every one of the 297 compiled workflows includes a redaction step, and none place secrets at the job-level env: — all secret references occur at the step level, which limits blast radius and keeps secrets out of job-wide environments.
2. Token cascade is the dominant pattern: GITHUB_TOKEN (5,308 refs) and GH_AW_GITHUB_TOKEN (4,577 refs) dominate usage, consistent with the standard fallback chain (GH_AW_GITHUB_MCP_SERVER_TOKEN → GH_AW_GITHUB_TOKEN → GITHUB_TOKEN) used 1,005 times across workflows for MCP server auth.
3. Observability secrets are widespread but scoped: OpenTelemetry secrets (Sentry, Grafana auth/endpoints) appear 744/497/495/248 times respectively — these are optional and used only where telemetry export is configured, not universally required.
4. AI engine credentials well distributed: OPENAI_API_KEY (431), CODEX_API_KEY (430), and ANTHROPIC_API_KEY (252) reflect the multiple supported agentic engines, each scoped to their respective workflows.

💡 Recommendations

1. Maintain 100% redaction coverage: Continue enforcing redact_secrets in every compiled workflow via the compiler — this is currently at parity (297/297) and should be a regression-tested invariant.
2. Periodically audit the token cascade: With 1,005 cascade usages, confirm GH_AW_GITHUB_MCP_SERVER_TOKEN scoping remains the most restrictive available token wherever configured, to avoid unnecessary privilege escalation via fallback to GITHUB_TOKEN.
3. No action needed on template injection or output exposure: Both automated Go tests (TestCompiledLockFiles_NoGitHubEventExpressionsInRunScripts, TestCompiledLockFiles_NoSecretsInOutputs) pass cleanly; keep these in CI as regression guards.

🔑 Top 10 Secrets by Usage

Rank	Secret Name	Occurrences	Type
1	GITHUB_TOKEN	5,308	GitHub Token
2	GH_AW_GITHUB_TOKEN	4,577	GitHub Token
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	1,928	GitHub Token (MCP)
4	GH_AW_OTEL_SENTRY_AUTHORIZATION	744	Observability
5	COPILOT_GITHUB_TOKEN	582	GitHub Token (Copilot engine)
6	GH_AW_OTEL_SENTRY_ENDPOINT	497	Observability
7	GH_AW_OTEL_GRAFANA_AUTHORIZATION	495	Observability
8	OPENAI_API_KEY	431	AI Engine
9	CODEX_API_KEY	430	AI Engine
10	ANTHROPIC_API_KEY	252	AI Engine

📈 Trends

No historical baseline discussion was found in the repository (this is the first recorded run of this analysis, or prior baselines have expired/been closed). Trend comparison will be available starting with tomorrow's run once this report's stats are used as a baseline.

📖 Reference Documentation

For detailed information about secret usage patterns, see:

• Specification: scratchpad/secrets-yml.md
• Redaction System: actions/setup/js/redact_secrets.cjs

---

Generated: 2026-09-01T17:41:56Z
Workflow: Daily Secrets Analysis

Generated by 🔒 Daily Secrets Analysis Agent · copilot · auto · 21.4 AIC · ⌖ 8.51 AIC · ⊞ 9.3K · ◷

• expires on Sep 4, 2026, 9:46 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Daily Secrets Analysis Agent.

A newer discussion is available at Discussion #57995.