[daily secrets] Daily Secrets Analysis Report

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-08-21
Workflow Files Analyzed: 286
Run: https://github.com/github/gh-aw/actions/runs/32509740265

📊 Executive Summary

• Total Secret References: 9,733 (secrets.*)
• GitHub Token References: 2,131 (github.token)
• Unique Secret Types: 39
• Job-Level Usage: 0 (0%)
• Step-Level Usage: 4,540 (100%)

🛡️ Security Posture

✅ Redaction System: 286/286 workflows have redaction steps
✅ Token Cascades: 1,023 instances of fallback chains (GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN)
✅ Permission Blocks: 286 explicit permission definitions (1 per workflow)

Template Injection Check: Found 4,818 raw occurrences of github.event. across lock files, but all are confined to env: key/value assignments (the standard gh-aw pattern of copying event fields into environment variables before use), not direct inline interpolation inside run:/script bodies. This is the expected, safe pattern — no raw expression injection into shell commands was found.

Secrets in Outputs Check: Initial grep matched 38 lines, but manual inspection shows these are env: blocks for steps that happen to fall within 5 lines of an unrelated outputs: key elsewhere in the same file (e.g. ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }} used as a step env var, not exposed via job outputs:). No secrets are actually written to job outputs.

🎯 Key Findings

1. 100% redaction coverage: Every one of the 286 compiled workflows includes a redact_secrets step, consistent with gh-aw's safety-by-default design.
2. Token cascade widely adopted: 1,023 usages of the GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN fallback chain indicate consistent, standardized token resolution across workflows rather than ad-hoc token handling.
3. All secret usage is step-level: No job-level env: blocks reference secrets directly — secrets are consumed exclusively at the step level, which limits blast radius/scope of exposure per step rather than exposing secrets to an entire job.
4. GITHUB_TOKEN and GH_AW_GITHUB_TOKEN dominate usage (5,026 and 4,327 occurrences respectively), together accounting for ~96% of all secret references — expected given nearly every workflow needs repo API access.
5. No template-injection or output-exposure anomalies were found in this scan; github.event.* fields are consistently routed through env: before use, and no secrets leak into job outputs:.

💡 Recommendations

1. Continue enforcing the redaction + step-level-only secret pattern via compiler/lint checks so any future workflow additions can't regress to job-level or output-level secret exposure.
2. Track the growing secret surface (39 unique secret types) — consider periodically auditing whether all are still required/used, to minimize the credentials each workflow can access.

🔑 Top 10 Secrets by Usage

Rank	Secret Name	Occurrences	Type
1	GITHUB_TOKEN	5026	GitHub Token
2	GH_AW_GITHUB_TOKEN	4327	GitHub Token
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	1880	GitHub Token
4	GH_AW_OTEL_SENTRY_AUTHORIZATION	735	Observability
5	COPILOT_GITHUB_TOKEN	729	GitHub Token
6	GH_AW_OTEL_SENTRY_ENDPOINT	491	Observability
7	GH_AW_OTEL_GRAFANA_AUTHORIZATION	489	Observability
8	ANTHROPIC_API_KEY	269	LLM API Key
9	GH_AW_OTEL_GRAFANA_ENDPOINT	245	Observability
10	OPENAI_API_KEY	107	LLM API Key

📈 Trends

No historical stats file was found in this environment (first run/no persisted baseline available), so day-over-day comparison could not be performed this cycle. Once a persisted baseline exists, future reports will include deltas for secret references, new/removed secret types, and cascade adoption.

📖 Reference Documentation

For detailed information about secret usage patterns, see:

• Specification: scratchpad/secrets-yml.md
• Redaction System: actions/setup/js/redact_secrets.cjs

---

Generated: 2026-08-21T17:46:44Z
Workflow: Daily Secrets Analysis

Generated by 🔒 Daily Secrets Analysis Agent · auto · 18.3 AIC · ⌖ 4.22 AIC · ⊞ 9.3K · ◷

• expires on Aug 24, 2026, 9:49 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Daily Secrets Analysis Agent.

A newer discussion is available at Discussion #55123.