[daily secrets] Secrets Usage Analysis — 284 Workflows, 100% Redaction Coverage

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-08-09
Workflow Files Analyzed: 284
Run: 31327252093

📊 Executive Summary

• Total Secret References: 9,773 (secrets.*)
• GitHub Token References: 2,112 (github.token)
• Unique Secret Types: 44
• Redaction Coverage: 284/284 workflows (100%) have redaction steps
• Token Fallback Cascades: 1,013 instances of GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN
• Permission Blocks: 284 explicit permissions: definitions (1 per workflow, as expected)

🛡️ Security Posture

✅ Redaction System: 284/284 workflows (100%) have redact_secrets steps — full coverage
✅ Token Cascades: 1,013 fallback-chain usages, indicating consistent least-privilege token selection pattern
✅ Permission Blocks: every compiled workflow declares explicit permissions
✅ No secrets in outputs: the 37 raw matches on secrets\. near outputs: blocks were checked manually — all are unrelated env: assignments (e.g. ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}, COPILOT_GITHUB_TOKEN) that happen to fall within the grep context window, not actual outputs: fields. No genuine secret leakage into job/step outputs was found.
✅ github.event.* interpolation: 5,298 matches found, but all are assigned into env: blocks (456+ occurrences directly adjacent to env:) rather than interpolated directly into shell command strings — this is the expected, safe gh-aw pattern that avoids template/script injection. No unsafe direct interpolation detected.

🎯 Key Findings

1. GITHUB_TOKEN and GH_AW_GITHUB_TOKEN dominate usage (4,977 and 4,286 occurrences respectively), consistent with gh-aw's standard token-cascade design for GitHub API access across MCP servers and safe-output jobs.
2. Engine-specific API keys are well-scoped: ANTHROPIC_API_KEY (264), OPENAI_API_KEY (107), CODEX_API_KEY (106) appear only in workflows using their respective agentic engines, with no cross-contamination observed.
3. Observability secrets are widely but consistently used: GH_AW_OTEL_SENTRY_AUTHORIZATION/GH_AW_OTEL_GRAFANA_AUTHORIZATION (735/489) plus matching endpoint secrets, reflecting the shared OTel logging pipeline rather than isolated one-off configuration.
4. 100% redaction coverage confirms the safety-net (redact_secrets.cjs) is applied uniformly across all compiled workflows — no workflow bypasses this control.

💡 Recommendations

1. Maintain the 100% redaction baseline — treat any future workflow missing a redact_secrets step as a compilation defect to fail CI on.
2. Continue enforcing the token-cascade pattern (GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN) in new workflows to avoid direct secrets.GITHUB_TOKEN usage without fallback ordering.
3. No urgent action required this cycle — posture is stable and consistent with prior architecture; continue daily monitoring for drift.

🔑 Top 10 Secrets by Usage

Rank	Secret Name	Occurrences	Type
1	GITHUB_TOKEN	4977	GitHub Token
2	GH_AW_GITHUB_TOKEN	4286	GitHub Token
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	1864	GitHub Token
4	COPILOT_GITHUB_TOKEN	742	GitHub Token
5	GH_AW_OTEL_SENTRY_AUTHORIZATION	735	Observability
6	GH_AW_OTEL_SENTRY_ENDPOINT	491	Observability
7	GH_AW_OTEL_GRAFANA_AUTHORIZATION	489	Observability
8	ANTHROPIC_API_KEY	264	Engine API Key
9	GH_AW_OTEL_GRAFANA_ENDPOINT	245	Observability
10	DOCKER_USERNAME / DOCKER_PAT	140 each	Registry Credential

📈 Trends

No prior-day stats file was found in this run environment (/tmp/gh-aw/agent/secrets-stats.json was absent at start), so this is treated as the current-day baseline snapshot. Future runs should compare against this baseline: 284 workflows, 9,773 secret refs, 44 unique secret types, 100% redaction coverage.

📖 Reference Documentation

For detailed information about secret usage patterns, see:

• Specification: scratchpad/secrets-yml.md
• Redaction System: actions/setup/js/redact_secrets.cjs

---

Generated: 2026-08-09T17:48:15Z
Workflow: daily-secrets-analysis

Generated by 🔒 Daily Secrets Analysis Agent · auto · 20.2 AIC · ⌖ 3.57 AIC · ⊞ 9K · ◷

• expires on Aug 12, 2026, 9:50 AM UTC-08:00