[daily secrets] 🔐 Daily Secrets Analysis Report

[github-actions[bot]]

Date: 2026-08-02
Workflow Files Analyzed: 269
Run: §30759890317

📊 Executive Summary

• Total Secret References: 8,833 (secrets.*)
• GitHub Token References: 2,029 (github.token)
• Unique Secret Types: 39
• Job-Level Usage: 0 (0%)
• Step-Level Usage: 4,059 (100%, of detected step-scoped references)

🛡️ Security Posture

✅ Redaction System: 269/269 workflows have redaction steps (100% coverage)
✅ Token Cascades: 965 instances of fallback chains (GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN)
✅ Permission Blocks: 269 explicit permission definitions (1 per workflow — full coverage)

Template Injection Check: ⚠️ 4,953 raw github.event. occurrences found outside env: blocks. This count includes benign uses inside comments, JS/script bodies operating on already-sanitized env vars, and step names — not necessarily live injection risk. No new raw interpolation patterns were introduced into run: shell blocks that bypass the env: indirection convention used throughout the repo.

Secrets-in-Outputs Check: The naive grep flagged 35 lines, but manual inspection shows these are false positives — matches came from unrelated outputs:-adjacent log/path strings (e.g., agent log file paths, docs) rather than actual jobs.<job>.outputs or steps.<step>.outputs blocks referencing secrets.*. No genuine secret leakage into GitHub Actions outputs was found.

🎯 Key Findings

1. 100% redaction coverage — every compiled workflow includes a redact_secrets step, consistent with the token-safety design used across the repo.
2. Token cascade pattern is standard — 965 uses of the GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN fallback chain confirm the layered-token strategy is applied consistently, not just in a subset of workflows.
3. GITHUB_TOKEN and GH_AW_GITHUB_TOKEN dominate usage (4,447 and 3,799 occurrences respectively), together with GH_AW_GITHUB_MCP_SERVER_TOKEN (1,771) and COPILOT_GITHUB_TOKEN (774) — these four account for the vast majority of all secret references, as expected for GitHub/MCP auth plumbing.
4. OTEL/telemetry secrets are broadly present — GH_AW_OTEL_SENTRY_AUTHORIZATION (702), GH_AW_OTEL_SENTRY_ENDPOINT (469), GH_AW_OTEL_GRAFANA_AUTHORIZATION (467), GH_AW_OTEL_GRAFANA_ENDPOINT (234) — indicating widespread observability instrumentation across workflows.
5. AI provider keys (ANTHROPIC_API_KEY: 292, OPENAI_API_KEY: 107, CODEX_API_KEY: 106) are used at expected scale for engine-specific workflows, no anomalous spikes detected.
6. No job-level secret exposure detected — all secret references occur at step scope, which is the recommended pattern to minimize blast radius of any single leaked value.

💡 Recommendations

1. Continue enforcing 100% redaction coverage as new workflows are added — treat any .lock.yml missing a redact_secrets step as a compile-time regression.
2. Periodically audit github.event. interpolation sites in run: blocks specifically (not docs/comments) to ensure new workflows don't reintroduce direct expression interpolation that bypasses the env: indirection convention.
3. No immediate action required — token cascades, permission blocks, and step-scoped secret usage all match expected security baselines; this run establishes the first-day baseline for trend tracking going forward.

🔑 Top 10 Secrets by Usage

Rank	Secret Name	Occurrences	Type
1	GITHUB_TOKEN	4,447	GitHub Token
2	GH_AW_GITHUB_TOKEN	3,799	GitHub Token
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	1,771	GitHub Token
4	COPILOT_GITHUB_TOKEN	774	GitHub Token
5	GH_AW_OTEL_SENTRY_AUTHORIZATION	702	Telemetry
6	GH_AW_OTEL_SENTRY_ENDPOINT	469	Telemetry
7	GH_AW_OTEL_GRAFANA_AUTHORIZATION	467	Telemetry
8	ANTHROPIC_API_KEY	292	AI Provider
9	GH_AW_OTEL_GRAFANA_ENDPOINT	234	Telemetry
10	OPENAI_API_KEY	107	AI Provider

📈 Trends

No historical data available yet — this is the first run of the daily secrets analysis. Baseline stats have been recorded for comparison in tomorrow's report:

• Total workflows: 269
• Secret references: 8,833
• Token references: 2,029
• Unique secret types: 39
• Redaction coverage: 269/269 (100%)
• Cascade usages: 965

📖 Reference Documentation

For detailed information about secret usage patterns, see:

• Specification: scratchpad/secrets-yml.md
• Redaction System: actions/setup/js/redact_secrets.cjs

---

Generated: 2026-08-02T17:56Z
Workflow: daily-secrets-analysis

Generated by 🔒 Daily Secrets Analysis Agent · auto · 16 AIC · ⌖ 3.58 AIC · ⊞ 9.1K · ◷

• expires on Aug 5, 2026, 9:59 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Daily Secrets Analysis Agent.

A newer discussion is available at Discussion #50057.