[daily secrets] Secrets Analysis Report — 2026-07-07

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-07-07
Workflow Files Analyzed: 258
Run: §28888666545

📊 Executive Summary

Metric	Value
Total secrets.* References	7,580
github.token References	1,573
Unique Secret Types	40
Files Using Token Cascade Fallback	258/258 (100%)
AI Model Secrets Coverage	256/258 (99.2%)

🛡️ Security Posture

✅ Redaction System: 258/258 workflows have redact_secrets steps
✅ Token Cascade: 930 fallback chain instances (GH_AW_GITHUB_MCP_SERVER_TOKEN || GH_AW_GITHUB_TOKEN || GITHUB_TOKEN)
✅ Explicit Permissions: 258/258 workflows define permissions: blocks
✅ No Secrets in Job Outputs: Confirmed zero direct secret exposures in outputs: definitions
✅ No secrets: inherit: Zero passthrough inheritance patterns detected

⚠️ Observations

1. github.event.* in non-env contexts (4,594 instances): These appear in if: conditions and Handlebars template blocks — standard compiled workflow patterns. GitHub Actions evaluates if: conditions securely without shell interpolation. Not a true injection risk.
2. Smoke workflows without AI secrets: smoke-copilot-aoai-apikey.lock.yml and smoke-copilot-aoai-entra.lock.yml rely on Azure/Copilot credentials instead of direct AI API keys — expected for Azure OpenAI smoke tests.
3. 10 single-use secrets: SLACK_BOT_TOKEN, OPENROUTER_API_KEY, GH_AW_OTEL_DATADOG_ENDPOINT appear in only 1–2 workflows — appropriate specialization.

🎯 Key Findings

1. Near-universal token cascade adoption: 100% of workflows use the recommended fallback pattern (930 cascade references across 258 files), ensuring graceful secret fallback.
2. Full redaction coverage: Every workflow (258/258) includes the redact_secrets step, ensuring no secrets leak into logs.
3. 40 distinct secret types span AI providers (Anthropic, OpenAI, Gemini, Codex), observability platforms (Sentry, Grafana, Datadog), GitHub tokens, and 3rd-party integrations.
4. GITHUB_TOKEN and GH_AW_GITHUB_TOKEN are universal — present in all 258 workflows, totaling 4,253 and 3,332 references respectively.

💡 Recommendations

1. Review Azure secrets usage: AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, AZURE_TENANT_ID appear in only the mcp-inspector workflow. Verify these are intentional and the workflow is properly scoped.
2. Monitor rare secrets: OPENROUTER_API_KEY (1 workflow), SLACK_BOT_TOKEN (1 workflow) — document purpose and ensure rotation policies are in place.
3. Track newer AI providers: CODEX_API_KEY (14 workflows) and FOUNDRY_API_KEY (3 workflows) represent expanding AI provider integrations; ensure credential management policies cover these.

🔑 Top 15 Secrets by File Coverage

Rank	Secret Name	Workflows	Total Refs
1	GITHUB_TOKEN	258	4,253
2	GH_AW_GITHUB_TOKEN	258	3,332
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	258	1,407
4	GH_AW_OTEL_SENTRY_AUTHORIZATION	237	711
5	GH_AW_OTEL_SENTRY_ENDPOINT	237	475
6	GH_AW_OTEL_GRAFANA_AUTHORIZATION	236	473
7	GH_AW_OTEL_GRAFANA_ENDPOINT	236	237
8	COPILOT_GITHUB_TOKEN	117	452
9	ANTHROPIC_API_KEY	62	242
10	GH_AW_CI_TRIGGER_TOKEN	60	60
11	OPENAI_API_KEY	15	81
12	CODEX_API_KEY	14	80
13	GH_AW_AGENT_TOKEN	15	15
14	TAVILY_API_KEY	5	12
15	SENTRY_ACCESS_TOKEN	—	10

🔬 Secret Categories

Category	Secrets	Scope
GitHub Tokens	GITHUB_TOKEN, GH_AW_GITHUB_TOKEN, GH_AW_GITHUB_MCP_SERVER_TOKEN, COPILOT_GITHUB_TOKEN, GH_AW_AGENT_TOKEN, GH_AW_PROJECT_GITHUB_TOKEN, GH_AW_CI_TRIGGER_TOKEN, GH_AW_SIDE_REPO_PAT, AWI_MAINTENANCE_TOKEN	Universal / scoped
AI Providers	ANTHROPIC_API_KEY, OPENAI_API_KEY, GEMINI_API_KEY, CODEX_API_KEY, FOUNDRY_API_KEY, FOUNDRY_OPENAI_ENDPOINT, OPENROUTER_API_KEY, ANTIGRAVITY_API_KEY	Model-specific workflows
Observability	GH_AW_OTEL_SENTRY_*, GH_AW_OTEL_GRAFANA_*, GH_AW_OTEL_DATADOG_*, DD_*, GRAFANA_*, SENTRY_*	Telemetry pipelines
3rd-party Tools	BRAVE_API_KEY, TAVILY_API_KEY, NOTION_API_TOKEN, SLACK_BOT_TOKEN, CONTEXT	Specialized workflows
Azure / Cloud	AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, AZURE_TENANT_ID	mcp-inspector only

📖 Reference Documentation

• Secrets specification: scratchpad/secrets-yml.md
• Redaction system: actions/setup/js/redact_secrets.cjs
• Token cascade pattern: GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN

---

Generated: 2026-07-07 18:27 UTC
Workflow: §28888666545

Generated by 🔒 Daily Secrets Analysis Agent · 45.3 AIC · ⌖ 14.3 AIC · ⊞ 6.2K · ◷

• expires on Jul 10, 2026, 10:31 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Daily Secrets Analysis Agent.

A newer discussion is available at Discussion #44381.