[daily secrets] 🔐 Daily Secrets Analysis Report — 2026-07-04

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-07-04
Workflow Files Analyzed: 258
Run: §28714760645

---

📊 Executive Summary

Metric	Value
Total secrets.* References	7,580
github.token References	1,569
Unique Secret Names	39
Workflows Analyzed	258
Workflows with Redaction	258 / 258 (100%)
Workflows with Permission Blocks	258 / 258 (100%)
Token Cascade Patterns	930

---

🛡️ Security Posture

✅ Redaction System: 258/258 workflows have redact_secrets steps — full coverage
✅ Permission Blocks: 258/258 workflows define explicit permissions: — full coverage
✅ Token Cascade Chains: 930 instances of GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN fallback pattern
✅ Secrets in Job Outputs: None found — no secret values leaked through job output bindings
✅ secrets: inherit: Not used in any workflow — all secrets are explicitly declared
✅ github.event.* Usage: All occurrences are safe env-var assignments via ${{ }} expressions, not raw shell interpolations

---

🎯 Key Findings

1. GitHub auth tokens dominate: Tokens for GitHub API access (GITHUB_TOKEN, GH_AW_GITHUB_TOKEN, GH_AW_GITHUB_MCP_SERVER_TOKEN, COPILOT_GITHUB_TOKEN) account for 9,555 references — the vast majority of all secret usage. This reflects the agent-heavy, GitHub-centric nature of these workflows.

2. AI/LLM keys are tightly scoped: The 450 references to AI API keys (Anthropic, OpenAI, Codex, Gemini, etc.) are concentrated in agent-runner steps. ANTHROPIC_API_KEY leads with 242 occurrences, consistent with Claude-based agentic workflows.

3. Observability stack is well-instrumented: 1,956 references to OTEL/Sentry/Grafana secrets confirm comprehensive telemetry coverage. Sentry (711 auth + 475 endpoint) and Grafana (473 auth + 237 endpoint) are the primary backends.

4. High-complexity workflows identified: mcp-inspector.lock.yml uses 23 distinct secret types — the most diverse in the repo. smoke-otel-backends.lock.yml (19 types) and daily-token-consumption-report.lock.yml (13 types) follow. These are prime candidates for periodic review.

5. Cloud/third-party credentials are limited in scope: Azure credentials (AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, AZURE_TENANT_ID) appear only in smoke-copilot-aoai-entra.lock.yml. Slack (SLACK_BOT_TOKEN) and Notion (NOTION_API_TOKEN) are each used in exactly one workflow.

---

💡 Recommendations

1. Review mcp-inspector.lock.yml periodically: With 23 distinct secret types, this workflow is the highest-complexity credential consumer. Verify that all 23 secrets remain necessary and actively rotate any that are long-lived.

2. Audit Datadog migration status: DD_API_KEY, DD_APP_KEY, DD_APPLICATION_KEY, and DD_SITE appear in 7–10 references each, alongside GH_AW OTEL variants. Confirm whether Datadog integration is fully active or transitional.

3. Confirm GH_AW_OTEL_DATADOG_* usage: Only 2 references to GH_AW_OTEL_DATADOG_API_KEY and 1 to GH_AW_OTEL_DATADOG_ENDPOINT — very low usage. Verify these are intentionally limited or remove if unused.

4. Monitor CONTEXT and OPENROUTER_API_KEY: Each appears only once (2 and 1 reference respectively). Confirm these are deliberate single-use secrets or candidates for removal.

---

🔑 Top 20 Secrets by Usage

Rank	Secret Name	Occurrences	Category
1	GITHUB_TOKEN	4,253	GitHub Auth
2	GH_AW_GITHUB_TOKEN	3,332	GitHub Auth
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	1,407	GitHub Auth
4	github.token (direct)	1,569*	GitHub Auth
5	GH_AW_OTEL_SENTRY_AUTHORIZATION	711	Observability
6	GH_AW_OTEL_SENTRY_ENDPOINT	475	Observability
7	GH_AW_OTEL_GRAFANA_AUTHORIZATION	473	Observability
8	COPILOT_GITHUB_TOKEN	452	GitHub Auth
9	ANTHROPIC_API_KEY	242	AI/LLM
10	GH_AW_OTEL_GRAFANA_ENDPOINT	237	Observability
11	OPENAI_API_KEY	81	AI/LLM
12	CODEX_API_KEY	80	AI/LLM
13	GH_AW_CI_TRIGGER_TOKEN	60	GitHub Auth
14	GH_AW_SIDE_REPO_PAT	24	GitHub Auth
15	GH_AW_AGENT_TOKEN	15	GitHub Auth
16	TAVILY_API_KEY	12	AI/LLM
17	SENTRY_OPENAI_API_KEY	10	AI/LLM
18	SENTRY_ACCESS_TOKEN	10	Observability
19	DD_APP_KEY	10	Observability
20	DD_APPLICATION_KEY	10	Observability

* github.token counted separately from secrets.* references

🗂️ Secret Categories Breakdown

Category	Unique Secrets	Total References
GitHub Auth Tokens	9	9,555
Observability (OTEL/Sentry/Grafana/Datadog)	13	1,956
AI / LLM API Keys	11	450
Cloud Providers (Azure)	3	6
Third-Party Integrations (Slack, Notion, Grafana direct)	4	19
Other / Misc	3	9

Note: Does not include the 1,569 github.token direct references.

🏆 Highest Complexity Workflows (by distinct secret types)

Workflow	Distinct Secret Types	Total Secret Refs
mcp-inspector	23	62
smoke-otel-backends	19	52
daily-token-consumption-report	13	—
daily-model-inventory	12	—
smoke-project	11	38

📖 Reference Documentation

• Secret usage specification: scratchpad/secrets-yml.md
• Redaction system: actions/setup/js/redact_secrets.cjs
• OTEL integration: .github/workflows/smoke-otel-backends.lock.yml

---

Generated: 2026-07-04T17:57 UTC
Workflow Run: §28714760645

Generated by 🔒 Daily Secrets Analysis Agent · 37.3 AIC · ⌖ 8.17 AIC · ⊞ 6.3K · ◷

• expires on Jul 7, 2026, 10:02 AM UTC-08:00