[daily secrets] 🔐 Secrets Analysis Report — 2026-07-18

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-07-18
Workflow Files Analyzed: 258
Run: §29654770275

📊 Executive Summary

Metric	Value
Total secrets.* references	8,205 (excl. false positive)
github.token references	1,677
Unique secret types	40 real (41 detected, 1 false positive)
Workflows with AI API keys	78 / 258 (30%)
Workflows without any secrets	0 — all workflows use secrets

🛡️ Security Posture

✅ Redaction System: 258/258 workflows (100%) have redact_secrets steps
✅ Token Cascades: 929 instances of fallback chains (GH_AW_GITHUB_MCP_SERVER_TOKEN || GH_AW_GITHUB_TOKEN || GITHUB_TOKEN)
✅ Permission Blocks: 258/258 workflows (100%) have explicit permissions: definitions
✅ Secrets in job outputs: 33 matches were OTEL header constructs (expected pattern — not raw secret leakage)
⚠️ Template expressions: 4,620 github.event.* references outside env: blocks (standard compiled pattern — verify no raw user input is unsanitized)

🎯 Key Findings

1. Full coverage of redaction and permissions: Every single compiled workflow has both a redact_secrets step and an explicit permissions: block — the security baseline is uniformly applied.
2. False positive in secret scan: secrets.cjs (258 hits) is a grep artifact from redact_secrets.cjs file paths — not a real secret. Actual unique secret count is 40.
3. GITHUB_TOKEN dominates: GITHUB_TOKEN (4,272) + GH_AW_GITHUB_TOKEN (3,654) account for ~96% of all GitHub-token references, with the 3-tier cascade (GH_AW_GITHUB_MCP_SERVER_TOKEN || GH_AW_GITHUB_TOKEN || GITHUB_TOKEN) appearing 929 times — healthy fallback pattern.
4. 78 workflows (30%) use AI provider keys: ANTHROPIC_API_KEY (243), OPENAI_API_KEY (93), CODEX_API_KEY (92), GEMINI_API_KEY (5), OPENROUTER_API_KEY (1) — broad AI provider coverage with appropriate secret isolation per step.
5. OTEL/observability secrets are well-standardized: Sentry, Grafana, and Datadog authorization headers follow a consistent pattern via GH_AW_OTEL_* secrets.

💡 Recommendations

1. Suppress false positive in future scans: The secrets.cjs match (from require(...redact_secrets.cjs)) should be excluded from grep patterns — use grep -P "secrets\.[A-Z]" to restrict to uppercase secret names.
2. Audit github.event.* outside env: While the 4,620 occurrences follow the standard compiled template pattern (contextual expressions in GH_AW_EXPR_* env vars), a periodic review should confirm no raw github.event. values flow unfiltered into shell commands.
3. Review CONTEXT secret (2 usages): This generic name is opaque — validate it is still needed and rename to something descriptive.
4. Azure credentials (AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, AZURE_TENANT_ID) appear only in 2 workflows each — confirm these are intentionally scoped and not overlooked.

🔑 Top 15 Secrets by Usage

Rank	Secret Name	Occurrences	Category
1	GITHUB_TOKEN	4,272	GitHub Token
2	GH_AW_GITHUB_TOKEN	3,654	GitHub Token (custom PAT)
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	1,703	GitHub Token (MCP)
4	COPILOT_GITHUB_TOKEN	727	GitHub Token (Copilot)
5	GH_AW_OTEL_SENTRY_AUTHORIZATION	696	Observability
6	GH_AW_OTEL_SENTRY_ENDPOINT	465	Observability
7	GH_AW_OTEL_GRAFANA_AUTHORIZATION	463	Observability
8	GH_AW_OTEL_GRAFANA_ENDPOINT	232	Observability
9	ANTHROPIC_API_KEY	243	AI Provider
10	OPENAI_API_KEY	93	AI Provider
11	CODEX_API_KEY	92	AI Provider
12	GH_AW_CI_TRIGGER_TOKEN	59	CI/CD
13	GH_AW_SIDE_REPO_PAT	24	GitHub Token (side repo)
14	GH_AW_AGENT_TOKEN	15	Agent runtime
15	TAVILY_API_KEY	12	AI/Search

📋 Full Secret Inventory (40 secrets)

GitHub Tokens (6): GITHUB_TOKEN, GH_AW_GITHUB_TOKEN, GH_AW_GITHUB_MCP_SERVER_TOKEN, COPILOT_GITHUB_TOKEN, GH_AW_PROJECT_GITHUB_TOKEN, GH_AW_SIDE_REPO_PAT

AI Providers (7): ANTHROPIC_API_KEY, OPENAI_API_KEY, CODEX_API_KEY, GEMINI_API_KEY, OPENROUTER_API_KEY, SENTRY_OPENAI_API_KEY, FOUNDRY_API_KEY / FOUNDRY_OPENAI_ENDPOINT

Observability (13): GH_AW_OTEL_SENTRY_AUTHORIZATION, GH_AW_OTEL_SENTRY_ENDPOINT, GH_AW_OTEL_GRAFANA_AUTHORIZATION, GH_AW_OTEL_GRAFANA_ENDPOINT, GH_AW_OTEL_DATADOG_API_KEY, GH_AW_OTEL_DATADOG_ENDPOINT, DD_API_KEY, DD_APPLICATION_KEY, DD_APP_KEY, DD_SITE, GRAFANA_SERVICE_ACCOUNT_TOKEN, GRAFANA_URL, SENTRY_ACCESS_TOKEN

Cloud/Infrastructure (3): AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, AZURE_TENANT_ID

Other (9): GH_AW_CI_TRIGGER_TOKEN, GH_AW_AGENT_TOKEN, AWI_MAINTENANCE_TOKEN, TAVILY_API_KEY, BRAVE_API_KEY, SLACK_BOT_TOKEN, NOTION_API_TOKEN, ANTIGRAVITY_API_KEY, CONTEXT

📖 Reference Documentation

• Specification: scratchpad/secrets-yml.md
• Redaction System: actions/setup/js/redact_secrets.cjs

---

Generated: 2026-07-18 17:55 UTC
Workflow: §29654770275

Generated by 🔒 Daily Secrets Analysis Agent · 29.9 AIC · ⌖ 7.56 AIC · ⊞ 6.2K · ◷

• expires on Jul 21, 2026, 10:00 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Daily Secrets Analysis Agent.

A newer discussion is available at Discussion #46634.