[daily secrets] Daily Secrets Analysis Report - 2026-08-28

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-08-28
Workflow Files Analyzed: 297
Run: https://github.com/github/gh-aw/actions/runs/33211469513

📊 Executive Summary

• Total Secret References: 10,550 (secrets.*)
• GitHub Token References: 2,211 (github.token)
• Unique Secret Types: 40
• Step-Level Usage: 4,898 (~46.4% of references matched in step contexts; the compiler emits all secret usage inline within step env:/with: blocks rather than job-level env:, so job-level count is 0)

🛡️ Security Posture

✅ Redaction System: 297/297 workflows have redaction steps (100% coverage)
✅ Token Cascades: 1,036 instances of fallback chains (GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN)
✅ Permission Blocks: 297 explicit permission definitions (1 per workflow, full coverage)

Automated security checks (Go tests):

• ✅ TestCompiledLockFiles_NoGitHubEventExpressionsInRunScripts — PASSED. No direct github.event.* interpolation found in run: scripts (template injection risk).
• ✅ TestCompiledLockFiles_NoSecretsInOutputs — PASSED. No secrets detected in job outputs or workflow_call outputs.

🎯 Key Findings

1. Full redaction coverage: All 297 compiled workflows include a redact_secrets step, ensuring accidental secret leakage into logs is mitigated consistently across the fleet.
2. GITHUB_TOKEN dominates usage: GITHUB_TOKEN (5,337) and GH_AW_GITHUB_TOKEN (4,607) together account for ~94% of all secret references, reflecting heavy reliance on GitHub's built-in token and the gh-aw wrapper token rather than custom PATs.
3. Long tail of specialized secrets: 40 unique secret types are in use, with a long tail of low-frequency, provider-specific secrets (e.g., SLACK_BOT_TOKEN, GH_AW_OTEL_DATADOG_ENDPOINT at 1–2 occurrences each) tied to niche integrations (Slack, Datadog, Grafana, Sentry, AI providers like Anthropic/Gemini/Cursor/Kiro).
4. No template injection or output-leak issues detected: Both deterministic Go safety tests pass clean, indicating the compiler's escaping and output-schema enforcement are working as intended fleet-wide.

💡 Recommendations

1. Continue enforcing 100% redaction coverage: Treat any future workflow missing a redact_secrets step as a compile-time failure, since today's fleet has zero exceptions.
2. Audit low-frequency secrets periodically: Secrets used only 1-2 times (e.g., SLACK_BOT_TOKEN, GH_AW_OTEL_DATADOG_ENDPOINT) are good candidates for a quarterly review to confirm they're still needed and scoped minimally.
3. Maintain token cascade pattern: The 1,036 fallback-chain usages (GH_AW_GITHUB_MCP_SERVER_TOKEN || GH_AW_GITHUB_TOKEN || GITHUB_TOKEN) provide graceful degradation — keep this pattern as the standard for any new GitHub API-calling workflow.

🔑 Top 10 Secrets by Usage

Rank	Secret Name	Occurrences	Type
1	GITHUB_TOKEN	5,337	GitHub Token
2	GH_AW_GITHUB_TOKEN	4,607	GitHub Token (gh-aw wrapper)
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	1,959	GitHub MCP Server Token
4	COPILOT_GITHUB_TOKEN	749	Copilot Token
5	GH_AW_OTEL_SENTRY_AUTHORIZATION	744	Observability (Sentry)
6	GH_AW_OTEL_SENTRY_ENDPOINT	497	Observability (Sentry)
7	GH_AW_OTEL_GRAFANA_AUTHORIZATION	495	Observability (Grafana)
8	ANTHROPIC_API_KEY	282	AI Provider
9	GH_AW_OTEL_GRAFANA_ENDPOINT	248	Observability (Grafana)
10	DOCKER_USERNAME	176	Container Registry

📈 Trends

No historical baseline is available yet for this report (first run with persisted comparison data not found). Today's stats have been captured as the baseline:

• Total workflows: 297
• Total secret refs: 10,550
• Unique secret types: 40
• Redaction coverage: 100%

Future runs will compare against this baseline once historical data persistence is wired up.

📖 Reference Documentation

For detailed information about secret usage patterns, see:

• Specification: scratchpad/secrets-yml.md
• Redaction System: actions/setup/js/redact_secrets.cjs

---

Generated: 2026-08-28T21:15Z
Workflow: .github/workflows/ (daily-secrets-analysis)

Generated by 🔒 Daily Secrets Analysis Agent · copilot · auto · 20.5 AIC · ⌖ 6.02 AIC · ⊞ 9.4K · ◷

• expires on Aug 31, 2026, 1:18 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Daily Secrets Analysis Agent.

A newer discussion is available at Discussion #56935.