[daily secrets] Secrets Analysis Report — 2026-07-17

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-07-17
Workflow Files Analyzed: 258
Run: §29601845517

---

📊 Executive Summary

Metric	Value
Total secrets.* references	8,463
github.token references	1,677
Combined secret references	10,140
Unique secret types	40
Workflows with redaction	258 / 258 (100%)
Token cascade chains	929
Explicit permission blocks	258 / 258 (100%)

---

🛡️ Security Posture

✅ Redaction System: All 258 workflows include redact_secrets steps — full coverage
✅ Permission Blocks: All 258 workflows have explicit permissions: declarations
✅ Token Cascades: 929 instances of GH_AW_GITHUB_MCP_SERVER_TOKEN || GH_AW_GITHUB_TOKEN || GITHUB_TOKEN fallback chains — consistent least-privilege pattern
✅ Secrets in Job Outputs: The one detected match (github-token in bot-detection.lock.yml) is a with: input parameter to an action, not a true output exposure — false positive
i️ Event Interpolation: 4,620 github.event.* references outside env: blocks — these are standard Actions expression patterns (numeric IDs, not free-text), expected for agentic workflows

---

🎯 Key Findings

1. GitHub token dominance: The top three secrets (GITHUB_TOKEN 4,272 · GH_AW_GITHUB_TOKEN 3,654 · GH_AW_GITHUB_MCP_SERVER_TOKEN 1,703) account for 88% of all secrets.* references, reflecting the core MCP gateway authentication model.
2. Observability secrets are wide: Sentry, Grafana, and Datadog credentials appear in 696, 463, and 8–10 workflows respectively — consistent with per-job telemetry wiring.
3. AI provider keys are targeted: ANTHROPIC_API_KEY (243), OPENAI_API_KEY (93), CODEX_API_KEY (92) are used in a subset of agent workflows, appropriately scoped.
4. Low-use secrets deserve review: 12 secrets appear ≤6 times (SLACK_BOT_TOKEN, OPENROUTER_API_KEY, CONTEXT, AWI_MAINTENANCE_TOKEN, etc.) — confirm they are still active and needed.

---

💡 Recommendations

1. Audit low-frequency secrets: Investigate the 12 secrets used ≤6 times. If any are deprecated, remove them from workflow files to reduce the secret surface.
2. Monitor COPILOT_GITHUB_TOKEN: At 727 references it is the 4th-most-used token. Confirm it cannot be substituted with the already-cascaded GH_AW_GITHUB_MCP_SERVER_TOKEN to reduce token types.
3. Periodically validate cascade correctness: The 929 token cascade instances should all follow the canonical 3-part form. A grep audit confirming no truncated chains (e.g., missing || secrets.GITHUB_TOKEN fallback) is recommended monthly.

---

🔑 Top 10 Secrets by Usage

Rank	Secret Name	Occurrences	Category
1	GITHUB_TOKEN	4,272	GitHub built-in token
2	GH_AW_GITHUB_TOKEN	3,654	GitHub PAT (repo-scoped)
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	1,703	MCP gateway token
4	COPILOT_GITHUB_TOKEN	727	Copilot auth token
5	GH_AW_OTEL_SENTRY_AUTHORIZATION	696	Observability (Sentry)
6	GH_AW_OTEL_SENTRY_ENDPOINT	465	Observability (Sentry)
7	GH_AW_OTEL_GRAFANA_AUTHORIZATION	463	Observability (Grafana)
8	ANTHROPIC_API_KEY	243	AI provider
9	GH_AW_OTEL_GRAFANA_ENDPOINT	232	Observability (Grafana)
10	OPENAI_API_KEY	93	AI provider

📋 Low-Frequency Secrets (≤6 uses)

Secret Name	Count	Notes
SLACK_BOT_TOKEN	1	Single notification workflow
OPENROUTER_API_KEY	1	Single AI routing workflow
GH_AW_OTEL_DATADOG_ENDPOINT	1	Datadog telemetry
FOUNDRY_API_KEY	3	Foundry AI provider
AWI_MAINTENANCE_TOKEN	4	Maintenance automation
BRAVE_API_KEY	4	Search tool
GH_AW_PROJECT_GITHUB_TOKEN	4	Project board token
CONTEXT	2	Contextual data secret
AZURE_CLIENT_ID	2	Azure auth
AZURE_CLIENT_SECRET	2	Azure auth
AZURE_TENANT_ID	2	Azure auth
ANTIGRAVITY_API_KEY	6	External API

📖 Reference Documentation

• Secrets specification: scratchpad/secrets-yml.md
• Redaction system: actions/setup/js/redact_secrets.cjs

---

Generated: 2026-07-17 17:57 UTC
Workflow: §29601845517

Generated by 🔒 Daily Secrets Analysis Agent · 27.6 AIC · ⌖ 7.44 AIC · ⊞ 6.2K · ◷

• expires on Jul 20, 2026, 10:02 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Daily Secrets Analysis Agent.

A newer discussion is available at Discussion #46466.