[daily secrets] Secret Usage Analysis Report — 2026-07-25 #48048
Closed
Replies: 1 comment
|
This discussion has been marked as outdated by Daily Secrets Analysis Agent. A newer discussion is available at Discussion #48211. |
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
🔐 Daily Secrets Analysis Report
Date: 2026-07-25
Workflow Files Analyzed: 262
Run: §30168538514
📊 Executive Summary
secrets.*referencesgithub.tokenreferencesSecret references are heavily concentrated in a handful of high-frequency tokens — GitHub auth tokens and observability secrets account for the majority of usage.
🛡️ Security Posture
redact_secrets)permissions:blocksenv:(not inline)outputs:All 262 workflows have both redaction steps and explicit permission blocks — excellent baseline security hygiene.
github.event.*references appear inenv:variable assignments only, which is the safe pattern (value is assigned to an env var, not interpolated into a script string directly).🎯 Key Findings
Token cascade pattern is pervasive: 939 instances of
GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN— this is an intentional defense-in-depth pattern providing graceful fallback across token types.Observability secrets are the 3rd largest group: OTEL/Sentry/Grafana secrets (
GH_AW_OTEL_SENTRY_AUTHORIZATION× 702,GH_AW_OTEL_SENTRY_ENDPOINT× 469,GH_AW_OTEL_GRAFANA_AUTHORIZATION× 467,GH_AW_OTEL_GRAFANA_ENDPOINT× 234) are widely replicated across workflows, reflecting that telemetry is baked into the compiled output of most workflows.42 unique secret types: A wide surface area. Several low-frequency secrets (≤ 2 uses:
AZURE_*,AI_GATEWAY_API_KEY,OPENROUTER_API_KEY,SLACK_BOT_TOKEN,GH_AW_OTEL_DATADOG_*) are potentially orphaned or experimental — worth auditing if the corresponding integrations are still active.Spurious entry
cjs: The grep pattern forsecrets.[A-Z_a-z]*matched a partial token from a compiled shell script (redact_secrets.cjs). This is a false positive from the extraction regex, not a real secret name.💡 Recommendations
Audit low-frequency secrets: Secrets used ≤ 4 times (
AZURE_CLIENT_ID/SECRET/TENANT_ID,AI_GATEWAY_API_KEY,OPENROUTER_API_KEY,SLACK_BOT_TOKEN,GH_AW_OTEL_DATADOG_*,GH_AW_PROJECT_GITHUB_TOKEN,AWI_MAINTENANCE_TOKEN) may be obsolete. Confirm they are still needed or remove them to shrink the attack surface.Tighten secret extraction regex: The analysis script should use
secrets\.[A-Z_]+(uppercase only) to avoid capturing lowercase-mixed filenames likeredact_secrets.cjs.Continue 100% redaction coverage: The current policy of redaction steps in every workflow is a strong control — maintain as workflows are added.
🔑 Top 10 Secrets by Usage
GITHUB_TOKENGH_AW_GITHUB_TOKENGH_AW_GITHUB_MCP_SERVER_TOKENCOPILOT_GITHUB_TOKENGH_AW_OTEL_SENTRY_AUTHORIZATIONGH_AW_OTEL_SENTRY_ENDPOINTGH_AW_OTEL_GRAFANA_AUTHORIZATIONANTHROPIC_API_KEYGH_AW_OTEL_GRAFANA_ENDPOINTOPENAI_API_KEY📋 All 42 Secret Types by Usage
GITHUB_TOKENGH_AW_GITHUB_TOKENGH_AW_GITHUB_MCP_SERVER_TOKENCOPILOT_GITHUB_TOKENGH_AW_OTEL_SENTRY_AUTHORIZATIONGH_AW_OTEL_SENTRY_ENDPOINTGH_AW_OTEL_GRAFANA_AUTHORIZATIONANTHROPIC_API_KEYGH_AW_OTEL_GRAFANA_ENDPOINTOPENAI_API_KEYCODEX_API_KEYGH_AW_CI_TRIGGER_TOKENGH_AW_SIDE_REPO_PATGH_AW_AGENT_TOKENTAVILY_API_KEYSENTRY_OPENAI_API_KEYSENTRY_ACCESS_TOKENDD_APP_KEYDD_APPLICATION_KEYDD_API_KEYDD_SITENOTION_API_TOKENGRAFANA_URLGRAFANA_SERVICE_ACCOUNT_TOKENFOUNDRY_OPENAI_ENDPOINTANTIGRAVITY_API_KEYGEMINI_API_KEYGH_AW_PROJECT_GITHUB_TOKENBRAVE_API_KEYAWI_MAINTENANCE_TOKENFOUNDRY_API_KEYGH_AW_OTEL_DATADOG_API_KEYCONTEXTAZURE_TENANT_IDAZURE_CLIENT_SECRETAZURE_CLIENT_IDAI_GATEWAY_API_KEYSLACK_BOT_TOKENOPENROUTER_API_KEYGH_AW_OTEL_DATADOG_ENDPOINT📖 Reference Documentation
scratchpad/secrets-yml.mdactions/setup/js/redact_secrets.cjsGenerated: 2026-07-25T17:56 UTC
Workflow: §30168538514
All reactions