[daily secrets] Daily Secrets Analysis Report - 2026-09-06

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-09-06
Workflow Files Analyzed: 299
Run: https://github.com/github/gh-aw/actions/runs/34049222194

📊 Executive Summary

• Total Secret References: 10,370 (secrets.*)
• GitHub Token References: 2,159 (github.token)
• Unique Secret Types: 41
• Job-Level Usage: 0 (grep heuristic returned 0 — most secrets are wired at step level)
• Step-Level Usage: 4,585 (~44% of raw secrets.* matches occur inside step blocks)

🛡️ Security Posture

✅ Redaction System: 299/299 workflows have redaction steps (100% coverage)
✅ Token Cascades: 1,014 instances of GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN fallback chains
✅ Permission Blocks: 299 explicit permissions: definitions (one per workflow, least-privilege enforced)

✅ No direct github.event.* interpolation found in run: scripts (TestCompiledLockFiles_NoGitHubEventExpressionsInRunScripts passed)
✅ No secrets detected in job outputs (TestCompiledLockFiles_NoSecretsInOutputs passed)

🎯 Key Findings

1. GITHUB_TOKEN dominates usage — 5,348 occurrences, consistent with its role as the default auth token across nearly every job/step.
2. Token cascade pattern is pervasive — GH_AW_GITHUB_MCP_SERVER_TOKEN (1,945 refs) combined with 1,014 full three-way fallback chains shows the MCP server auth design is applied uniformly, not just in a handful of workflows.
3. Observability secrets are significant — Sentry (744+497 for auth/endpoint) and Grafana (495+248) OTEL credentials account for ~1,984 references, reflecting broad telemetry instrumentation across workflows.
4. AI provider keys are diverse but low-volume individually — OPENAI_API_KEY (463), CODEX_API_KEY (462), ANTHROPIC_API_KEY (255), plus smaller counts for GEMINI, KIRO, CURSOR, FOUNDRY — indicating multi-engine support with per-engine credential isolation rather than a shared universal key.
5. Long tail of specialized integration secrets — Datadog (DD_API_KEY, DD_APP_KEY, etc.), Jira, Linear, Slack, and Squad GitHub App credentials each appear only 1–8 times, consistent with narrowly-scoped integration workflows.

💡 Recommendations

1. Maintain redaction parity: Redaction coverage is currently 100% (299/299) — ensure any newly added workflow templates include the redaction step by default in CI validation.
2. Audit low-usage secrets periodically: Secrets referenced only 1–2 times (e.g. GH_AW_OTEL_DATADOG_ENDPOINT, JIRA_API_TOKEN, SLACK_BOT_TOKEN) should be reviewed quarterly to confirm the workflows using them are still active and the secrets aren't orphaned.
3. Continue enforcing template-injection and output-exposure tests: Both TestCompiledLockFiles_NoGitHubEventExpressionsInRunScripts and TestCompiledLockFiles_NoSecretsInOutputs passed cleanly; keep these as required CI gates for every compiled lock file.

🔑 Top 15 Secrets by Usage

Rank	Secret Name	Occurrences	Type
1	GITHUB_TOKEN	5348	GitHub Token
2	GH_AW_GITHUB_TOKEN	4544	GitHub Token
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	1945	GitHub Token
4	GH_AW_OTEL_SENTRY_AUTHORIZATION	744	Observability
5	COPILOT_GITHUB_TOKEN	575	GitHub Token
6	GH_AW_OTEL_SENTRY_ENDPOINT	497	Observability
7	GH_AW_OTEL_GRAFANA_AUTHORIZATION	495	Observability
8	OPENAI_API_KEY	463	AI Provider
9	CODEX_API_KEY	462	AI Provider
10	ANTHROPIC_API_KEY	255	AI Provider
11	GH_AW_OTEL_GRAFANA_ENDPOINT	248	Observability
12	GH_AW_DEFAULT_OTLP_HEADERS	102	Observability
13	GH_AW_CI_TRIGGER_TOKEN	70	GitHub Token
14	GH_AW_SIDE_REPO_PAT	24	GitHub Token
15	GH_AW_AGENT_TOKEN	15	GitHub Token

📈 Trends

No prior-day stats file was available in this run's ephemeral environment to diff against, since /tmp/gh-aw/agent/secrets-stats.json does not persist between separate workflow runs. Compare this report's raw numbers against the previous "[daily secrets]" discussion (#58840, 2026-09-05) manually if a longitudinal trend is needed. This run's snapshot:

• Total workflows: 299
• Total secrets.* references: 10,370
• Total github.token references: 2,159
• Unique secret types: 41
• Redaction coverage: 299/299
• Token cascade count: 1,014

📖 Reference Documentation

For detailed information about secret usage patterns, see:

• Specification: scratchpad/secrets-yml.md
• Redaction System: actions/setup/js/redact_secrets.cjs

---

Generated: 2026-09-06 17:42 UTC
Workflow: Daily Secrets Analysis Agent

Generated by 🔒 Daily Secrets Analysis Agent · copilot · auto · 21.1 AIC · ⌖ 7.85 AIC · ⊞ 9.3K · ◷

• expires on Sep 9, 2026, 9:45 AM UTC-08:00