[daily secrets] Secrets Analysis Report – 2026-07-27

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-07-27
Workflow Files Analyzed: 263
Run: §30292291468

---

📊 Executive Summary

Metric	Value
secrets.* References	8,647
github.token References	1,857
Unique Secret Types	41
Step-Level Usage	4,065
Workflows Analyzed	263

GitHub token variants (GITHUB_TOKEN + GH_AW_GITHUB_TOKEN + GH_AW_GITHUB_MCP_SERVER_TOKEN) account for 9,790 references — the largest share of all secret usage, reflecting the heavy token-cascade pattern adopted across workflows.

---

🛡️ Security Posture

✅ Redaction System: 263/263 (100%) workflows include redact_secrets steps
✅ Token Cascade Pattern: 943 instances of GH_AW_GITHUB_MCP_SERVER_TOKEN || GH_AW_GITHUB_TOKEN || GITHUB_TOKEN fallback chains
✅ Permission Blocks: 263 explicit permissions: definitions (100% coverage)
✅ Secrets in Job Outputs: 33 occurrences reviewed — all are env-block assignments, not raw output exposure

---

🎯 Key Findings

1. Complete redaction & permissions coverage — every compiled workflow has both a redact_secrets step and an explicit permissions: block. This is the expected baseline and is healthy.

2. Token cascade is widely used — 943 usages of the 3-tier token fallback chain ensures workflows degrade gracefully when premium tokens are unavailable, reducing hard failures.

3. AI API key diversification — 5 distinct AI provider keys are in use (ANTHROPIC_API_KEY ×272, OPENAI_API_KEY ×103, CODEX_API_KEY ×102, GEMINI_API_KEY ×5, OPENROUTER_API_KEY ×1). No single provider is a sole dependency.

4. github.event.* in non-env contexts — 4,690 lines reference github.event.* outside env: blocks (e.g., in if:, with:, Handlebars templates). These are standard compiled-workflow patterns, not injection risks, but warrant ongoing review as new workflows are added.

5. Singleton secrets (SLACK_BOT_TOKEN ×1, OPENROUTER_API_KEY ×1, GH_AW_OTEL_DATADOG_ENDPOINT ×1) — very low usage may indicate workflows that are candidates for deprecation or consolidation.

---

💡 Recommendations

1. Audit singleton secrets — review SLACK_BOT_TOKEN, OPENROUTER_API_KEY, and GH_AW_OTEL_DATADOG_ENDPOINT (1 usage each) to confirm they are still needed and rotate if stale.

2. Monitor AI key sprawl — with 5 AI provider keys and growing, consider documenting a provider preference matrix so new workflows choose the right key and avoid unnecessary secret proliferation.

3. Review ANTIGRAVITY_API_KEY — used in only 1 workflow; verify this secret is intentional and not a test artifact.

4. Establish historical baseline — this is the first automated daily snapshot. Future runs will enable trend detection for secret additions, removals, and usage spikes.

---

🔑 Top 20 Secrets by Usage

Rank	Secret Name	Occurrences	Category
1	GITHUB_TOKEN	4,344	GitHub Token
2	GH_AW_GITHUB_TOKEN	3,715	GitHub Token
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	1,731	GitHub Token
4	COPILOT_GITHUB_TOKEN	755	GitHub Token
5	GH_AW_OTEL_SENTRY_AUTHORIZATION	702	Observability
6	GH_AW_OTEL_SENTRY_ENDPOINT	469	Observability
7	GH_AW_OTEL_GRAFANA_AUTHORIZATION	467	Observability
8	ANTHROPIC_API_KEY	272	AI / LLM
9	GH_AW_OTEL_GRAFANA_ENDPOINT	234	Observability
10	OPENAI_API_KEY	103	AI / LLM
11	CODEX_API_KEY	102	AI / LLM
12	GH_AW_CI_TRIGGER_TOKEN	60	CI/CD
13	GH_AW_SIDE_REPO_PAT	24	GitHub Token
14	GH_AW_AGENT_TOKEN	15	CI/CD
15	TAVILY_API_KEY	12	External API
16	SENTRY_OPENAI_API_KEY	10	Observability
17	SENTRY_ACCESS_TOKEN	10	Observability
18	DD_APP_KEY	10	Observability
19	DD_APPLICATION_KEY	10	Observability
20	DD_API_KEY	8	Observability

📋 All 41 Unique Secret Types

Secret Name	Occurrences	Category
AI_GATEWAY_API_KEY	2	AI / LLM
ANTHROPIC_API_KEY	272	AI / LLM
ANTIGRAVITY_API_KEY	6	External API
AWI_MAINTENANCE_TOKEN	4	CI/CD
AZURE_CLIENT_ID	2	Cloud
AZURE_CLIENT_SECRET	2	Cloud
AZURE_TENANT_ID	2	Cloud
BRAVE_API_KEY	4	External API
CODEX_API_KEY	102	AI / LLM
CONTEXT	2	Internal
COPILOT_GITHUB_TOKEN	755	GitHub Token
DD_API_KEY	8	Observability
DD_APPLICATION_KEY	10	Observability
DD_APP_KEY	10	Observability
DD_SITE	7	Observability
FOUNDRY_API_KEY	3	External API
FOUNDRY_OPENAI_ENDPOINT	6	External API
GEMINI_API_KEY	5	AI / LLM
GH_AW_AGENT_TOKEN	15	CI/CD
GH_AW_CI_TRIGGER_TOKEN	60	CI/CD
GH_AW_GITHUB_MCP_SERVER_TOKEN	1,731	GitHub Token
GH_AW_GITHUB_TOKEN	3,715	GitHub Token
GH_AW_OTEL_DATADOG_API_KEY	2	Observability
GH_AW_OTEL_DATADOG_ENDPOINT	1	Observability
GH_AW_OTEL_GRAFANA_AUTHORIZATION	467	Observability
GH_AW_OTEL_GRAFANA_ENDPOINT	234	Observability
GH_AW_OTEL_SENTRY_AUTHORIZATION	702	Observability
GH_AW_OTEL_SENTRY_ENDPOINT	469	Observability
GH_AW_PROJECT_GITHUB_TOKEN	4	GitHub Token
GH_AW_SIDE_REPO_PAT	24	GitHub Token
GITHUB_TOKEN	4,344	GitHub Token
GRAFANA_SERVICE_ACCOUNT_TOKEN	6	Observability
GRAFANA_URL	6	Observability
NOTION_API_TOKEN	6	External API
OPENAI_API_KEY	103	AI / LLM
OPENROUTER_API_KEY	1	AI / LLM
SENTRY_ACCESS_TOKEN	10	Observability
SENTRY_OPENAI_API_KEY	10	Observability
SLACK_BOT_TOKEN	1	Notifications
TAVILY_API_KEY	12	External API
AWI_MAINTENANCE_TOKEN	4	CI/CD

📈 Trends

This is the first automated run of the daily secrets analysis. No historical baseline exists yet.

Future runs will track:

• Δ in total secrets.* references vs previous day
• New secret types introduced
• Secret types removed or falling to zero usage
• Spike detection in any single secret's usage

📖 Reference Documentation

• Specification: scratchpad/secrets-yml.md
• Redaction System: actions/setup/js/redact_secrets.cjs
• Token cascade pattern: documented in .github/skills/agentic-workflows/SKILL.md

---

Generated: 2026-07-27 18:09 UTC
Workflow Run: §30292291468

Generated by 🔒 Daily Secrets Analysis Agent · sonnet46 · 24.2 AIC · ⌖ 5.63 AIC · ⊞ 6.3K · ◷

• expires on Jul 30, 2026, 10:12 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Daily Secrets Analysis Agent.

A newer discussion is available at Discussion #48704.