[daily secrets] Secrets Analysis Report — 2026-07-03

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-07-03
Workflow Files Analyzed: 258
Run: §28676455290

📊 Executive Summary

Metric	Value
Total secrets.* References	7,580
github.token References	1,569
Unique Secret Types	40
Workflows Analyzed	258

All 258 compiled workflows were successfully analyzed. The secret landscape is broad — 40 distinct secret types spanning GitHub tokens, AI API keys, observability integrations, and CI infrastructure tokens.

🛡️ Security Posture

Control	Status	Coverage
Secret Redaction Steps	✅ Active	258/258 (100%)
Token Cascade Fallback	✅ Active	258/258 (100%)
Explicit Permission Blocks	✅ Active	258/258 (100%)
Hardcoded Tokens	✅ None found	—
Secrets in Job Outputs	✅ None found	—

Security controls are uniformly applied across all workflows — full coverage on every key safeguard.

🎯 Key Findings

1. Token Cascade Pattern is Universal — All 258 workflows use the 3-tier token cascade (GH_AW_GITHUB_MCP_SERVER_TOKEN || GH_AW_GITHUB_TOKEN || GITHUB_TOKEN), ensuring graceful degradation while preferring least-privileged tokens.

2. Observability Integration is Well-Isolated — The Sentry (711 refs) and Grafana (473 refs) OTEL secrets are the dominant non-GitHub secrets, reflecting deep telemetry coverage. Their high reference count is expected given the agentic framework pattern.

3. No Custom-Token-Only Workflows — Every workflow that uses GITHUB_TOKEN also uses custom tokens (GH_AW_GITHUB_TOKEN, COPILOT_GITHUB_TOKEN, etc.), meaning no workflow relies solely on the built-in token without an upgrade path.

4. AI Provider Diversity — 8 distinct AI/LLM API keys are in use (Anthropic, OpenAI, Codex, Gemini, OpenRouter, Foundry, Sentry-OpenAI, Brave), indicating multi-provider strategy. This increases the secret surface area but also reduces single-vendor dependency.

5. github.event.* in Non-env: Contexts — The grep-based check flagged 4,593 hits, but investigation confirmed these are all proper ${{ }} expression syntax in if: conditions and env-var assignments — not template injection. No true injection risk was identified.

💡 Recommendations

1. Audit low-frequency secrets — SLACK_BOT_TOKEN (1 ref), OPENROUTER_API_KEY (1 ref), GH_AW_OTEL_DATADOG_ENDPOINT (1 ref) are used by only 1 workflow each. Verify these are still needed and consider consolidation.

2. Review Azure credentials — AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, AZURE_TENANT_ID each appear only twice. Confirm these are actively used and their workflows are appropriately scoped.

3. Monitor AI API key sprawl — With 8 AI providers, rotation hygiene is important. Consider a secret-rotation workflow to verify key freshness.

🔑 Top 14 Secrets by Usage

Rank	Secret Name	Occurrences	Category
1	GITHUB_TOKEN	4,253	GitHub Token
2	GH_AW_GITHUB_TOKEN	3,332	GitHub PAT
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	1,407	GitHub PAT (MCP)
4	GH_AW_OTEL_SENTRY_AUTHORIZATION	711	Observability
5	GH_AW_OTEL_SENTRY_ENDPOINT	475	Observability
6	GH_AW_OTEL_GRAFANA_AUTHORIZATION	473	Observability
7	COPILOT_GITHUB_TOKEN	452	GitHub PAT (Copilot)
8	ANTHROPIC_API_KEY	242	AI Provider
9	GH_AW_OTEL_GRAFANA_ENDPOINT	237	Observability
10	OPENAI_API_KEY	81	AI Provider
11	CODEX_API_KEY	80	AI Provider
12	GH_AW_CI_TRIGGER_TOKEN	60	CI Infrastructure
13	GH_AW_SIDE_REPO_PAT	24	GitHub PAT
14	GH_AW_AGENT_TOKEN	15	Agent Token

Remaining 26 secrets: Combined 88 references across Tavily, Sentry, DataDog, Grafana, Notion, Foundry, Antigravity, Gemini, Brave, AWI, Azure, Slack, OpenRouter context secrets.

📈 Secret Type Distribution

Category	Secrets Count	Total References	% of All Refs
GitHub Tokens	6	9,444+	~55%
Observability (OTEL)	8	1,898	~25%
AI/LLM API Keys	8	660	~9%
CI Infrastructure	3	75	~1%
Other (cloud, SaaS)	15	88	~1%

📖 Reference Documentation

• Secret specification: scratchpad/secrets-yml.md
• Redaction system: actions/setup/js/redact_secrets.cjs
• Token cascade pattern: GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN

---

Generated: 2026-07-03 18:04 UTC
Workflow: §28676455290

Generated by 🔒 Daily Secrets Analysis Agent · 26.4 AIC · ⌖ 12 AIC · ⊞ 6.3K · ◷

• expires on Jul 6, 2026, 10:08 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Daily Secrets Analysis Agent.

A newer discussion is available at Discussion #43424.