[daily secrets] Secrets Analysis Report — 2026-08-29

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-08-29
Workflow Files Analyzed: 297
Run: https://github.com/github/gh-aw/actions/runs/33266156371

📊 Executive Summary

• Total Secret References: 10,550 (secrets.*)
• GitHub Token References: 2,211 (github.token)
• Unique Secret Types: 40
• Redaction Coverage: 297/297 workflows (100%)

🛡️ Security Posture

✅ Redaction System: 297/297 workflows have redact_secrets steps (100% coverage)
✅ Token Cascades: 1,036 instances of the GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN fallback chain
✅ Permission Blocks: 297 explicit permissions: blocks (1 per workflow — least-privilege scoping in place)

Automated security checks (Go tests, pkg/workflow):

• ✅ TestCompiledLockFiles_NoGitHubEventExpressionsInRunScripts — PASSED. No direct github.event.* interpolation found in run: scripts (template-injection risk clear).
• ✅ TestCompiledLockFiles_NoSecretsInOutputs — PASSED. No secrets detected in job outputs or workflow_call outputs.

🎯 Key Findings

1. Token usage dominates secret references: GITHUB_TOKEN (5,337) and GH_AW_GITHUB_TOKEN (4,607) together account for ~94% of all secrets.* references, consistent with the standard token-cascade pattern used across the fleet rather than workflow-specific secrets.
2. Observability secrets are widespread but scoped: OTEL/Sentry and Grafana authorization + endpoint secrets (GH_AW_OTEL_SENTRY_AUTHORIZATION, GH_AW_OTEL_SENTRY_ENDPOINT, GH_AW_OTEL_GRAFANA_AUTHORIZATION, GH_AW_OTEL_GRAFANA_ENDPOINT) appear ~2,000 times combined, indicating consistent telemetry instrumentation adoption.
3. No template-injection or output-leak regressions: both automated Go-based structural checks passed cleanly against the full compiled fleet, confirming safe-outputs and run-script sanitization remain intact.
4. Full redaction coverage maintained: every one of the 297 compiled workflows includes a redact_secrets step, so no gaps in secret-masking were introduced by recent workflow additions/changes.

💡 Recommendations

1. Continue enforcing the token-cascade pattern (GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN) for any new workflows to keep the fallback behavior consistent across the fleet.
2. Periodically audit provider-specific keys (e.g., ANTHROPIC_API_KEY, DOCKER_USERNAME/DOCKER_PAT) for scope and rotation cadence, since these are less commonly reviewed than the GitHub token chain.
3. Keep both Go structural tests in CI (TestCompiledLockFiles_NoGitHubEventExpressionsInRunScripts, TestCompiledLockFiles_NoSecretsInOutputs) as required gates — they caught zero issues today but are the primary automated defense against template injection and output leakage.

🔑 Top 10 Secrets by Usage

Rank	Secret Name	Occurrences	Type
1	GITHUB_TOKEN	5,337	GitHub Token
2	GH_AW_GITHUB_TOKEN	4,607	GitHub Token
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	1,959	GitHub Token
4	COPILOT_GITHUB_TOKEN	749	GitHub Token
5	GH_AW_OTEL_SENTRY_AUTHORIZATION	744	Observability
6	GH_AW_OTEL_SENTRY_ENDPOINT	497	Observability
7	GH_AW_OTEL_GRAFANA_AUTHORIZATION	495	Observability
8	ANTHROPIC_API_KEY	282	Engine API Key
9	GH_AW_OTEL_GRAFANA_ENDPOINT	248	Observability
10	DOCKER_USERNAME	176	Registry Credential

📈 Trends

No historical baseline is available yet in this environment for day-over-day comparison. This run establishes the current-state snapshot (297 workflows, 10,550 secret references, 40 unique secret types) as the reference point for future reports.

📖 Reference Documentation

For detailed information about secret usage patterns, see:

• Redaction System: actions/setup/js/redact_secrets.cjs
• Structural checks: pkg/workflow/*_test.go (TestCompiledLockFiles_NoGitHubEventExpressionsInRunScripts, TestCompiledLockFiles_NoSecretsInOutputs)

---

Generated: 2026-08-29 17:41 UTC
Workflow: .github/workflows/agentic-secrets-audit.md (compiled to .lock.yml)

Generated by 🔒 Daily Secrets Analysis Agent · copilot · auto · 19.3 AIC · ⌖ 6.01 AIC · ⊞ 9.4K · ◷

• expires on Sep 1, 2026, 9:44 AM UTC-08:00