[daily secrets] Secret Usage Analysis – June 17, 2026

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: June 17, 2026
Workflow Files Analyzed: 250
Run: §27710626902

---

📊 Executive Summary

Metric	Value
Total secrets.* References	7,420
github.token References	1,512
Combined Secret References	8,932
Unique Secret Types	39
Workflows with Redaction	250 / 250 (100%)
Workflows with Permission Blocks	250 / 250 (100%)

---

🛡️ Security Posture

✅ Redaction System: All 250 workflows include redact_secrets steps — no raw secret values will appear in logs.
✅ Permission Blocks: Every workflow declares explicit permissions: — least-privilege principle applied universally.
✅ Token Cascades: 924 three-way and 2,679 two-way fallback chains enable graceful degradation without exposing unnecessary tokens.
✅ No Template Injection: Zero github.event.* references found directly in shell run: blocks — all event data is accessed through safe ${{ }} expression contexts or environment variables.
✅ No Secrets in Job Outputs: No secret values are propagated through job output definitions.
✅ No Hardcoded Credentials: All token: references in shell scripts use environment-variable indirection (${GITHUB_TOKEN}), set from secrets via env blocks.

---

🎯 Key Findings

1. GitHub tokens dominate (83% of secret refs): The three core token variants — GITHUB_TOKEN (4,172), GH_AW_GITHUB_TOKEN (3,286), and GH_AW_GITHUB_MCP_SERVER_TOKEN (1,376) — account for the majority of references, reflecting the platform-native token-cascade architecture.

2. Observability telemetry is pervasive (233 workflows, 93%): Sentry, Grafana, and DataDog secrets appear across nearly all workflows (GH_AW_OTEL_SENTRY_AUTHORIZATION alone: 697 refs), indicating a robust observability layer.

3. AI provider diversity (90 workflows, 10 providers): Anthropic (261 refs) leads among AI providers, with OpenAI/Codex (79/78), Tavily (13), and niche providers (Gemini, Foundry, Brave, OpenRouter, ANTIGRAVITY, Sentry-OpenAI) representing a multi-model strategy.

4. Cascade fallback patterns are systematic: The GH_AW_GITHUB_MCP_SERVER_TOKEN → GH_AW_GITHUB_TOKEN → GITHUB_TOKEN three-way chain appears 911 times, and GH_AW_GITHUB_TOKEN → GITHUB_TOKEN 2,679 times — intentional progressive-privilege patterns.

5. CONTEXT7_API_KEY gap in analysis: 7 references to CONTEXT7_API_KEY exist in workflows but were missed by the secrets\.[A-Z_]* extraction regex (it contains a digit). Minor analysis gap, not a security issue.

---

💡 Recommendations

1. No immediate security actions required: All critical controls (redaction, permissions, no-injection) confirmed in 100% of workflows.

2. Fix secret-name extraction regex: Update [A-Z_]* → [A-Z0-9_]* in future scans to capture alphanumeric secret names like CONTEXT7_API_KEY.

3. Document AI provider rotation matrix: With 10 distinct AI provider secrets across 90 workflows, create a documented matrix of which workflows use which providers to simplify key-rotation procedures.

4. Clarify DataDog dual-key alias: Both DD_APP_KEY and DD_APPLICATION_KEY appear in cascade expressions. Confirm this is intentional and document the canonical name to avoid confusion.

---

🔑 Top 15 Secrets by Usage

Rank	Secret Name	Occurrences	Category
1	GITHUB_TOKEN	4,172	GitHub Token
2	GH_AW_GITHUB_TOKEN	3,286	GitHub Token
3	github.token	1,512	GitHub Token (built-in)
4	GH_AW_GITHUB_MCP_SERVER_TOKEN	1,376	GitHub Token
5	GH_AW_OTEL_SENTRY_AUTHORIZATION	697	Observability
6	GH_AW_OTEL_SENTRY_ENDPOINT	466	Observability
7	GH_AW_OTEL_GRAFANA_AUTHORIZATION	464	Observability
8	COPILOT_GITHUB_TOKEN	421	GitHub Token
9	GH_AW_OTEL_GRAFANA_ENDPOINT	233	Observability
10	ANTHROPIC_API_KEY	261	AI Provider
11	OPENAI_API_KEY	79	AI Provider
12	CODEX_API_KEY	78	AI Provider
13	GH_AW_CI_TRIGGER_TOKEN	59	GitHub Token
14	TAVILY_API_KEY	13	AI Provider
15	GH_AW_AGENT_TOKEN	13	GitHub Token

🗂️ Secret Categories Breakdown

GitHub Tokens (secrets.* only, excluding github.token)

Secret	Occurrences
GITHUB_TOKEN	4,172
GH_AW_GITHUB_TOKEN	3,286
GH_AW_GITHUB_MCP_SERVER_TOKEN	1,376
COPILOT_GITHUB_TOKEN	421
GH_AW_CI_TRIGGER_TOKEN	59
GH_AW_SIDE_REPO_PAT	22
GH_AW_AGENT_TOKEN	13
GH_AW_PROJECT_GITHUB_TOKEN	7

Observability / Telemetry

Secret	Occurrences
GH_AW_OTEL_SENTRY_AUTHORIZATION	697
GH_AW_OTEL_SENTRY_ENDPOINT	466
GH_AW_OTEL_GRAFANA_AUTHORIZATION	464
GH_AW_OTEL_GRAFANA_ENDPOINT	233
DD_APPLICATION_KEY	10
DD_APP_KEY	10
DD_API_KEY	8
DD_SITE	7
GRAFANA_SERVICE_ACCOUNT_TOKEN	6
GRAFANA_URL	6
GH_AW_OTEL_DATADOG_API_KEY	2
GH_AW_OTEL_DATADOG_ENDPOINT	1

AI Providers

Secret	Occurrences
ANTHROPIC_API_KEY	261
OPENAI_API_KEY	79
CODEX_API_KEY	78
TAVILY_API_KEY	13
SENTRY_OPENAI_API_KEY	10
ANTIGRAVITY_API_KEY	6
FOUNDRY_OPENAI_ENDPOINT	6
GEMINI_API_KEY	5
BRAVE_API_KEY	4
FOUNDRY_API_KEY	3
OPENROUTER_API_KEY	1

Other

Secret	Occurrences
NOTION_API_TOKEN	6
CONTEXT	2
AZURE_CLIENT_ID	2
AZURE_CLIENT_SECRET	2
AZURE_TENANT_ID	2
SLACK_BOT_TOKEN	1

🔗 Token Cascade Patterns

The codebase uses systematic fallback chains to degrade gracefully from specialized tokens to the base GITHUB_TOKEN:

Pattern	Occurrences	Purpose
MCP_SERVER_TOKEN || GH_AW_GITHUB_TOKEN || GITHUB_TOKEN	911	MCP server auth with fallback
GH_AW_GITHUB_TOKEN || GITHUB_TOKEN	2,679	Standard GH_AW token fallback
GH_AW_AGENT_TOKEN || GH_AW_GITHUB_TOKEN || GITHUB_TOKEN	13	Agent session token fallback
CODEX_API_KEY || OPENAI_API_KEY	50	Codex/OpenAI API key alias
DD_APPLICATION_KEY || DD_APP_KEY	8	DataDog key name alias

📖 Reference Documentation

• Specification: scratchpad/secrets-yml.md
• Redaction System: actions/setup/js/redact_secrets.cjs
• All 250 workflows: .github/workflows/*.lock.yml

---

Generated: 2026-06-17T18:28:08Z
Workflow: §27710626902

References:

• §27710626902

Generated by 🔒 Daily Secrets Analysis Agent · ◷

• expires on Jun 20, 2026, 10:32 AM UTC-08:00