[daily secrets] Daily Secrets Analysis Report - 2026-08-18

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-08-18
Workflow Files Analyzed: 286
Run: https://github.com/github/gh-aw/actions/runs/32167195245

📊 Executive Summary

• Total Secret References: 9,745 (secrets.*)
• GitHub Token References: 2,131 (github.token)
• Unique Secret Types: 39
• Step-Level Usage: 4,473 references embedded in step env:/with: blocks (job-level env: blocks with direct secrets.* were not detected — usage is concentrated at the step level, consistent with the gh-aw compiler's design of injecting secrets only where needed)

🛡️ Security Posture

✅ Redaction System: 286/286 workflows have redaction steps (100% coverage)
✅ Token Cascades: 1,023 instances of GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN fallback chains
✅ Permission Blocks: 286 explicit permissions: definitions (100% coverage)

Template injection scan: 4,823 matches for github.event. across lock files. This count is expected — most of these are safely captured into intermediate env: variables before use (the standard gh-aw safe-templating pattern) rather than being interpolated directly into shell/script bodies. No new raw/unsafe interpolation patterns were flagged outside this pattern in this pass.

Secrets-in-outputs scan: 38 raw matches for secrets. near outputs: blocks. On inspection, these are false positives from the grep context window (adjacent outputs: keys in step configuration unrelated to job outputs) rather than genuine secret leakage into GITHUB_OUTPUT/job outputs. No confirmed secret exposure via outputs was found.

🎯 Key Findings

1. GITHUB_TOKEN dominates usage (5,026 occurrences) — expected, as it's the default auth token referenced by most steps (checkout, gh CLI, API calls).
2. GH_AW_GITHUB_TOKEN and GH_AW_GITHUB_MCP_SERVER_TOKEN are the next most common (4,327 and 1,880), reflecting the standard gh-aw token cascade for MCP server auth.
3. Observability secrets (GH_AW_OTEL_SENTRY_*, GH_AW_OTEL_GRAFANA_*) account for ~1,960 references, indicating broad adoption of OpenTelemetry/Sentry/Grafana integration across workflows.
4. AI provider keys (ANTHROPIC_API_KEY, OPENAI_API_KEY, CODEX_API_KEY) are present with moderate usage (106–269 occurrences each), consistent with multi-engine support.
5. 100% redaction and permission coverage across all 286 compiled workflows — a strong baseline security control with no regressions detected.

💡 Recommendations

1. Maintain the token cascade pattern (GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN) for all new workflows requiring GitHub API access — it's applied consistently (1,023 instances) and should stay the standard.
2. Periodically audit github.event.* usage to confirm all instances continue routing through intermediate env: variables rather than direct script interpolation, since the raw match count is large enough that manual spot-checks are more reliable than aggregate counts alone.
3. Consider tightening the "secrets near outputs" grep in future runs (e.g., restrict to GITHUB_OUTPUT writes) to reduce false-positive noise and make the check more actionable.

🔑 Top 10 Secrets by Usage

Rank	Secret Name	Occurrences	Type
1	GITHUB_TOKEN	5,026	GitHub Token
2	GH_AW_GITHUB_TOKEN	4,327	GitHub Token
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	1,880	GitHub Token
4	GH_AW_OTEL_SENTRY_AUTHORIZATION	735	Observability
5	COPILOT_GITHUB_TOKEN	729	GitHub Token
6	GH_AW_OTEL_SENTRY_ENDPOINT	491	Observability
7	GH_AW_OTEL_GRAFANA_AUTHORIZATION	489	Observability
8	ANTHROPIC_API_KEY	269	AI Provider
9	GH_AW_OTEL_GRAFANA_ENDPOINT	245	Observability
10	DOCKER_USERNAME / DOCKER_PAT	110 each	Registry Auth

📈 Trends

No historical baseline was found for comparison (first recorded run in this environment). Today's stats have been captured as the baseline for future daily comparisons:

• Total workflows: 286
• Total secret references: 9,745
• Unique secret types: 39
• Redaction coverage: 100%

📖 Reference Documentation

For detailed information about secret usage patterns, see:

• Specification: scratchpad/secrets-yml.md
• Redaction System: actions/setup/js/redact_secrets.cjs

---

Generated: 2026-08-18 17:47 UTC
Workflow: .github/workflows/ daily secrets analysis

Generated by 🔒 Daily Secrets Analysis Agent · auto · 16 AIC · ⌖ 5.8 AIC · ⊞ 9.3K · ◷

• expires on Aug 21, 2026, 9:49 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Daily Secrets Analysis Agent.

A newer discussion is available at Discussion #54057.