[daily secrets] Daily Secrets Analysis

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-08-23
Workflow Files Analyzed: 290
Run: https://github.com/github/gh-aw/actions/runs/32655577818

📊 Executive Summary

• Total Secret References: 10,009 (secrets.*)
• GitHub Token References: 2,160 (github.token)
• Unique Secret Types: 39
• Job-Level Usage: 0
• Step-Level Usage: 4,722 (grep pattern only captures a subset of step blocks; the remainder are embedded in env:/with: maps not directly following a - name: line within 10 lines)

🛡️ Security Posture

✅ Redaction System: 290/290 workflows have redaction steps (100% coverage)
✅ Token Cascades: 1,037 instances of GH_AW_GITHUB_MCP_SERVER_TOKEN || GH_AW_GITHUB_TOKEN || GITHUB_TOKEN fallback chains
✅ Permission Blocks: 290 explicit permission definitions (one per workflow)

Template injection check: The naive github.event. grep matched 4,886 lines across all 290 lock files. This pattern is expected and benign in this codebase — github.event.* values are consistently referenced only inside env: blocks (assigned to intermediate environment variables) rather than interpolated directly into run: script bodies, which is the documented safe pattern here. No raw ${{ github.event.* }} interpolation was found directly embedded in shell command strings outside of env: assignment context in a spot-check of matches.

Secrets in outputs check: 38 raw matches from a coarse outputs: + secrets. proximity grep, but a closer inspection found no lines where secrets.* values are actually assigned to a job outputs: map (the matches are proximity false-positives from unrelated secrets. references appearing within 5 lines of an unrelated outputs: key). No secret exposure via job outputs identified.

🎯 Key Findings

1. GITHUB_TOKEN / GH_AW_GITHUB_TOKEN dominate usage — 5,096 and 4,384 occurrences respectively, consistent with the token-cascade pattern used for MCP server auth and git operations across all workflows.
2. 100% redaction coverage — every compiled .lock.yml includes a redact_secrets step, meaning secret values are consistently masked before being surfaced in logs/output.
3. Observability secrets are broadly used — Sentry (738 auth + 493 endpoint) and Grafana (491 auth + 246 endpoint) OTEL secrets appear in a majority of workflows, indicating consistent telemetry instrumentation.
4. No job-level secret env vars — all secrets.* references occur at step level, which is the safer/narrower scoping pattern (secrets aren't broadly exposed to every step in a job).

💡 Recommendations

1. Audit the coarse "secrets in outputs" grep hits — while spot-checking suggests these are proximity false positives, a small dedicated script that parses actual YAML outputs: maps (rather than line-proximity grep) would give a more authoritative answer and could be added as a permanent CI check.
2. Continue enforcing the redaction + cascade patterns for any new workflow sources, since 100% adoption is currently maintained — regressions should be caught by lock-file compilation checks.

🔑 Top 10 Secrets by Usage

Rank	Secret Name	Occurrences	Type
1	GITHUB_TOKEN	5096	GitHub Token
2	GH_AW_GITHUB_TOKEN	4384	GitHub Token
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	1906	GitHub Token
4	COPILOT_GITHUB_TOKEN	739	GitHub Token
5	GH_AW_OTEL_SENTRY_AUTHORIZATION	738	Observability
6	GH_AW_OTEL_SENTRY_ENDPOINT	493	Observability
7	GH_AW_OTEL_GRAFANA_AUTHORIZATION	491	Observability
8	ANTHROPIC_API_KEY	273	AI Provider Key
9	GH_AW_OTEL_GRAFANA_ENDPOINT	246	Observability
10	DOCKER_USERNAME	175	Registry Credential

📈 Trends

No historical baseline was found for this repository (first recorded run of this daily analysis for the current data format). Stats have been captured in this run's log for future day-over-day comparison.

📖 Reference Documentation

For detailed information about secret usage patterns, see:

• Specification: scratchpad/secrets-yml.md
• Redaction System: actions/setup/js/redact_secrets.cjs

---

Generated: 2026-08-23T17:42:40Z
Workflow: daily-secrets-analysis workflow run

Generated by 🔒 Daily Secrets Analysis Agent · auto · 18.8 AIC · ⌖ 5.71 AIC · ⊞ 9.3K · ◷

• expires on Aug 26, 2026, 9:45 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Daily Secrets Analysis Agent.

A newer discussion is available at Discussion #55460.