[daily secrets] Daily Secrets Analysis Report

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-09-03
Workflow Files Analyzed: 298
Run: https://github.com/github/gh-aw/actions/runs/33785863049

📊 Executive Summary

Metric	Value
Total Secret References (secrets.*)	10,758
GitHub Token References (github.token)	2,221
Unique Secret Types	40
Workflows with Redaction Steps	298 / 298 (100%)
Token Cascade Instances	1,008
Explicit Permission Blocks	298 / 298 (100%)

🛡️ Security Posture

✅ Redaction System: 298/298 workflows have redact_secrets steps present.
✅ Token Cascades: 1,008 instances of the standard fallback chain (GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN) were found, indicating consistent use of the token-fallback pattern across workflows.
✅ Permission Blocks: 298/298 workflows declare an explicit permissions: block — no workflow relies on implicit/default permissions.
✅ Template Injection Check (TestCompiledLockFiles_NoGitHubEventExpressionsInRunScripts): PASS — no direct github.event.* interpolation found in executable run: scripts across all compiled lock files.
✅ Secrets-in-Outputs Check (TestCompiledLockFiles_NoSecretsInOutputs): PASS — no secrets detected in job outputs or workflow_call outputs.

🎯 Key Findings

1. GITHUB_TOKEN dominates usage: secrets.GITHUB_TOKEN (5,327 refs) and secrets.GH_AW_GITHUB_TOKEN (4,593 refs) together account for ~92% of all secret references, reflecting the standard GitHub-token-first design of the token cascade pattern used throughout the compiler.
2. MCP server token widely adopted: GH_AW_GITHUB_MCP_SERVER_TOKEN appears 1,934 times, consistent with the number of workflows wiring the GitHub MCP server with a dedicated token rather than falling back to the raw GITHUB_TOKEN.
3. Observability secrets are broadly deployed: OpenTelemetry-related secrets (GH_AW_OTEL_SENTRY_AUTHORIZATION 744, GH_AW_OTEL_SENTRY_ENDPOINT 497, GH_AW_OTEL_GRAFANA_AUTHORIZATION 495, GH_AW_OTEL_GRAFANA_ENDPOINT 248) indicate most workflows ship with tracing/telemetry wired in by default.
4. Engine API keys present as expected: OPENAI_API_KEY (431), CODEX_API_KEY (430), and ANTHROPIC_API_KEY (253) reflect the mix of AI engine backends configured across the workflow fleet.
5. 100% coverage on core security controls: every one of the 298 compiled workflows includes both a redaction step and an explicit permissions block — no gaps found.
6. No historical baseline yet: this is the first recorded run of daily secrets stats in this session; trend comparison will be available starting with the next report once /tmp/gh-aw/agent/secrets-stats.json-style data is persisted upstream.

💡 Recommendations

1. Continue relying on the automated Go tests (TestCompiledLockFiles_NoGitHubEventExpressionsInRunScripts, TestCompiledLockFiles_NoSecretsInOutputs) as CI gates — both passed cleanly today with zero findings.
2. Establish persistent day-over-day storage for secret usage stats (e.g., committing a small JSON snapshot or using discussion history) so future reports can show real deltas instead of static counts.
3. Periodically audit the long tail of secret types (40 unique names) to confirm all are still actively consumed and none are orphaned/unused in the workflow fleet.

🔑 Top 10 Secrets by Usage

Rank	Secret Name	Occurrences	Type
1	GITHUB_TOKEN	5,327	GitHub Token
2	GH_AW_GITHUB_TOKEN	4,593	GitHub Token
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	1,934	GitHub Token
4	GH_AW_OTEL_SENTRY_AUTHORIZATION	744	Observability
5	COPILOT_GITHUB_TOKEN	582	GitHub Token
6	GH_AW_OTEL_SENTRY_ENDPOINT	497	Observability
7	GH_AW_OTEL_GRAFANA_AUTHORIZATION	495	Observability
8	OPENAI_API_KEY	431	AI Engine
9	CODEX_API_KEY	430	AI Engine
10	ANTHROPIC_API_KEY	253	AI Engine

📈 Trends

No prior "[daily secrets]" discussion was found in the repository, so this is the baseline report. Future runs will compare against this data:

• Total secret references: 10,758 (baseline)
• Unique secret types: 40 (baseline)
• Redaction coverage: 100% (baseline)

📖 Reference Documentation

For detailed information about secret usage patterns, see:

• Specification: scratchpad/secrets-yml.md
• Redaction System: actions/setup/js/redact_secrets.cjs

---

Generated: 2026-09-03 17:43 UTC
Workflow: .github/workflows/

Generated by 🔒 Daily Secrets Analysis Agent · copilot · auto · 21.4 AIC · ⌖ 7.84 AIC · ⊞ 9.3K · ◷

• expires on Sep 6, 2026, 9:47 AM UTC-08:00