[daily secrets] Daily Secrets Analysis Report

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-08-25
Workflow Files Analyzed: 293
Run: https://github.com/github/gh-aw/actions/runs/32879699648

📊 Executive Summary

• Total Secret References: 10,301 (secrets.*)
• GitHub Token References: 2,194 (github.token)
• Unique Secret Types: 39
• Job-Level env: Usage: 0 direct matches via heuristic grep (job-level secrets are typically injected through step env: blocks, not job-level env:)
• Step-Level Usage: 4,826 occurrences (heuristic, - name: proximity match)

🛡️ Security Posture

✅ Redaction System: 293/293 workflows have redact_secrets steps (100% coverage)
✅ Token Cascades: 1,021 instances of the GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN fallback pattern
✅ Permission Blocks: 293 explicit permissions: blocks (one per workflow file — full coverage)

Template Injection Check: ⚠️ 4,946 lines contain github.event. references outside of env: blocks (heuristic grep, high false-positive rate — most are inside safely-quoted env: variable assignments feeding into JS/scripts rather than raw shell interpolation; a precise AST-based check would be needed to confirm safety per occurrence).

Secrets-in-Outputs Check: i️ Could not run TestCompiledLockFiles_NoSecretsInOutputs — the sandboxed Go toolchain attempted to download go1.26.6 and was blocked by network egress restrictions (403 Forbidden from proxy.golang.org). This check is enforced deterministically in CI; no local override was attempted.

🎯 Key Findings

1. Redaction is universal: All 293 compiled lock files include a redact_secrets step, indicating consistent enforcement of the secret-redaction safety net across the fleet.
2. GITHUB_TOKEN dominates usage: secrets.GITHUB_TOKEN (5,267 refs) and secrets.GH_AW_GITHUB_TOKEN (4,547 refs) together account for ~95% of all named secret references, consistent with the documented token-cascade design (GH_AW_GITHUB_MCP_SERVER_TOKEN → GH_AW_GITHUB_TOKEN → GITHUB_TOKEN).
3. Observability secrets are widespread but scoped: OTEL/Sentry/Grafana authorization and endpoint secrets (~1,984 combined refs) appear across many workflows, consistent with optional telemetry instrumentation rather than core execution paths.
4. Registry/API-key secrets are present in a minority of workflows: DOCKER_USERNAME/DOCKER_PAT (176 each), ANTHROPIC_API_KEY (282), OPENAI_API_KEY (88), CODEX_API_KEY (87) — these track engine-specific and container-registry workflows rather than fleet-wide usage.
5. No historical baseline available: This appears to be the first run captured for trend comparison (no prior "[daily secrets]" discussions found in the repository), so trend deltas cannot be computed yet.

💡 Recommendations

1. Re-run the outputs check in CI: Since the Go toolchain couldn't be provisioned in this sandbox, confirm the next scheduled CI run of TestCompiledLockFiles_NoSecretsInOutputs passes cleanly (it should already be enforced on every compile/test cycle).
2. Tighten the injection heuristic: The 4,946-line github.event. count is too noisy to act on directly. Consider a follow-up scan restricted to raw run:/script: shell blocks (excluding env:-assigned intermediate variables) to surface only genuine unguarded interpolations.
3. Establish a persisted baseline: Since no prior daily-secrets discussion exists, ensure the stats JSON (secrets-stats.json) or an equivalent artifact is retained between runs so future reports can show real day-over-day deltas.

🔑 Top 10 Secrets by Usage

Rank	Secret Name	Occurrences	Type
1	GITHUB_TOKEN	5,267	GitHub Token
2	GH_AW_GITHUB_TOKEN	4,547	GitHub Token
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	1,931	GitHub Token
4	COPILOT_GITHUB_TOKEN	750	GitHub Token
5	GH_AW_OTEL_SENTRY_AUTHORIZATION	744	Telemetry
6	GH_AW_OTEL_SENTRY_ENDPOINT	497	Telemetry
7	GH_AW_OTEL_GRAFANA_AUTHORIZATION	495	Telemetry
8	ANTHROPIC_API_KEY	282	Engine API Key
9	GH_AW_OTEL_GRAFANA_ENDPOINT	248	Telemetry
10	DOCKER_USERNAME / DOCKER_PAT	176 each	Registry Credential

📈 Trends

No historical "[daily secrets]" discussion was found in this repository, so no day-over-day comparison is available. This run establishes the baseline for future reports:

{
  "date": "2026-08-25",
  "total_workflows": 293,
  "secret_refs": 10301,
  "token_refs": 2194,
  "unique_secrets": 39,
  "redaction_count": 293,
  "cascade_count": 1021
}

📖 Reference Documentation

For detailed information about secret usage patterns, see:

• Specification: scratchpad/secrets-yml.md
• Redaction System: actions/setup/js/redact_secrets.cjs

---

Generated: 2026-08-25 17:54 UTC
Workflow: Daily Secrets Analysis Agent

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• proxy.golang.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "proxy.golang.org"

See Network Configuration for more information.

Generated by 🔒 Daily Secrets Analysis Agent · copilot · auto · 17.5 AIC · ⌖ 6.7 AIC · ⊞ 9.4K · ◷

• expires on Aug 28, 2026, 9:57 AM UTC-08:00