[daily secrets] Daily Secrets Analysis

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-08-20
Workflow Files Analyzed: 286
Run: https://github.com/github/gh-aw/actions/runs/32399328830

📊 Executive Summary

• Total Secret References: 9,744 (secrets.*)
• GitHub Token References: 2,131 (github.token)
• Unique Secret Types: 39
• Redaction Coverage: 286/286 workflows (100%)

🛡️ Security Posture

✅ Redaction System: 286/286 workflows (100%) have redact_secrets steps
✅ Token Cascades: 1,023 instances of GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN fallback chains
✅ Permission Blocks: 286 explicit permissions: blocks (1 per workflow — least-privilege declared everywhere)

Template injection check: 4,797 github.event.* matches found, but manual sampling confirms all occurrences are consistently isolated into intermediate env:-scoped GH_AW_EXPR_* variables (the standard gh-aw sanitization pattern) rather than interpolated directly into run:/script bodies — no unsafe direct interpolation detected. 284/286 lock files use this GH_AW_EXPR_ indirection pattern.

Secrets-in-outputs check: The naive scan flagged 38 lines, but these are false positives — they are env: blocks (e.g. ANTHROPIC_API_KEY, COPILOT_GITHUB_TOKEN) that happened to fall within 5 lines of an unrelated outputs: key, not secrets actually placed in job outputs: values. No genuine secret exposure via job outputs was found.

🎯 Key Findings

1. GITHUB_TOKEN dominates usage (5,026 refs, ~52% of all secret references), consistent with its role as the default auth fallback across nearly every workflow.
2. gh-aw's internal token hierarchy is heavily used: GH_AW_GITHUB_TOKEN (4,327) and GH_AW_GITHUB_MCP_SERVER_TOKEN (1,880) together account for ~64% of references, reflecting the standard MCP-server token cascade pattern.
3. Observability secrets are widespread: OpenTelemetry/Sentry/Grafana auth secrets (GH_AW_OTEL_SENTRY_AUTHORIZATION, GH_AW_OTEL_GRAFANA_AUTHORIZATION, endpoints) appear in 489–735 occurrences each, indicating most workflows ship with telemetry wiring enabled.
4. LLM provider keys present but scoped: ANTHROPIC_API_KEY (269) and Docker registry credentials (DOCKER_USERNAME/DOCKER_PAT, 110 each) are used only where the relevant engine/registry step requires them.
5. 100% redaction coverage — every compiled workflow includes a redact_secrets step, meaning secret values are consistently scrubbed from logs regardless of which secrets a workflow consumes.

💡 Recommendations

1. Maintain redaction coverage as a compiler invariant — continue enforcing that every new workflow template includes the redact_secrets step; consider adding a CI check that fails compilation if it's missing.
2. Periodically audit GH_AW_EXPR_* indirection for any new event-context fields introduced in workflow authoring, to ensure future github.event.* usages continue to route through sanitized env vars rather than being interpolated directly.
3. Review OTEL/observability secret scope — with telemetry secrets appearing in the majority of workflows, confirm these are optional and gracefully absent when telemetry is disabled, to avoid unnecessary secret surface area.

🔑 Top 10 Secrets by Usage

Rank	Secret Name	Occurrences	Type
1	GITHUB_TOKEN	5,026	GitHub Token
2	GH_AW_GITHUB_TOKEN	4,327	GitHub Token
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	1,880	GitHub Token
4	GH_AW_OTEL_SENTRY_AUTHORIZATION	735	Telemetry
5	COPILOT_GITHUB_TOKEN	729	GitHub Token
6	GH_AW_OTEL_SENTRY_ENDPOINT	491	Telemetry
7	GH_AW_OTEL_GRAFANA_AUTHORIZATION	489	Telemetry
8	ANTHROPIC_API_KEY	269	LLM Provider
9	GH_AW_OTEL_GRAFANA_ENDPOINT	245	Telemetry
10	DOCKER_USERNAME / DOCKER_PAT	110 each	Registry Credential

📈 Trends

No historical baseline is available yet (first recorded run in this session). Today's stats have been captured and will be used as the baseline for tomorrow's comparison:

• Total workflows: 286
• Secret refs: 9,744
• Token refs: 2,131
• Unique secret types: 39
• Redaction count: 286
• Cascade count: 1,023

📖 Reference Documentation

For detailed information about secret usage patterns, see:

• Specification: scratchpad/secrets-yml.md
• Redaction System: actions/setup/js/redact_secrets.cjs

---

Generated: 2026-08-20T17:48:10Z
Workflow: Daily Secrets Analysis Agent

Generated by 🔒 Daily Secrets Analysis Agent · auto · 14.8 AIC · ⌖ 4.72 AIC · ⊞ 9.3K · ◷

• expires on Aug 23, 2026, 9:50 AM UTC-08:00