[daily secrets] Secrets Analysis Report - 2026-09-09

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-09-09
Workflow Files Analyzed: 299
Run: https://github.com/github/gh-aw/actions/runs/34384161962

📊 Executive Summary

• Total Secret References: 10,253 (secrets.*)
• GitHub Token References: 2,214 (github.token)
• Unique Secret Types: 41
• Job-Level Usage: 0 (0.0%)
• Step-Level Usage: 4,558 (100.0%)

🛡️ Security Posture

✅ Redaction System: 299/299 workflows have redaction steps (100%)
✅ Token Cascades: 1,014 instances of fallback chains (GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN)
✅ Permission Blocks: 299 explicit permission definitions (1 per workflow — all workflows scope permissions)
✅ Template Injection Check: TestCompiledLockFiles_NoGitHubEventExpressionsInRunScripts — PASSED, no direct github.event.* interpolation in run: scripts
✅ Secrets-in-Outputs Check: TestCompiledLockFiles_NoSecretsInOutputs — PASSED, no secrets exposed via job outputs

🎯 Key Findings

1. All secret consumption is step-scoped: 100% of secret references occur at the step level (via env: in individual steps), with 0 job-level env: blocks referencing secrets — this is the tighter-scoping pattern and reduces blast radius if a step's output is logged.
2. GITHUB_TOKEN dominates usage: GITHUB_TOKEN (5,348 refs) and GH_AW_GITHUB_TOKEN (4,557 refs) together account for ~96% of all secrets.* references, reflecting the standard GitHub API token cascade pattern used across nearly every workflow.
3. Universal redaction coverage: Every one of the 299 compiled lock files includes a redact_secrets step, meaning secret-masking is applied consistently and no workflow was found lacking this safety net.
4. No unsafe echo of secret values: The 4 lines matching echo.*secrets\. are all human-readable error/log messages referencing secret names (e.g., "COPILOT_GITHUB_TOKEN must be configured...") — none print actual secret values.
5. Observability secrets are scoped and limited: OTEL/Sentry/Grafana authorization and endpoint secrets (~1,940 combined references) are used only for optional telemetry and follow the same redaction/cascade conventions as core tokens.

💡 Recommendations

1. Maintain the step-level-only pattern: Continue avoiding job-level env: blocks for secrets — this is a security strength worth preserving as new workflows are added.
2. No urgent action required: Both automated security checks (template injection, secrets-in-outputs) passed cleanly; posture is stable and no anomalies were found in this scan.

🔑 Top 10 Secrets by Usage

Rank	Secret Name	Occurrences	Type
1	GITHUB_TOKEN	5,348	GitHub Token
2	GH_AW_GITHUB_TOKEN	4,557	GitHub Token
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	1,945	GitHub Token
4	GH_AW_OTEL_SENTRY_AUTHORIZATION	744	Observability
5	COPILOT_GITHUB_TOKEN	527	GitHub Token
6	GH_AW_OTEL_SENTRY_ENDPOINT	497	Observability
7	GH_AW_OTEL_GRAFANA_AUTHORIZATION	495	Observability
8	OPENAI_API_KEY	398	AI Engine
9	CODEX_API_KEY	397	AI Engine
10	ANTHROPIC_API_KEY	255	AI Engine

📈 Trends

No prior-day stats file was found in this run's environment, so a day-over-day comparison could not be computed. Baseline captured this run: 299 workflows, 10,253 secrets.* refs, 2,214 github.token refs, 41 unique secret types, 1,014 cascade usages. Future runs should compare against this baseline where historical artifacts are available.

📖 Reference Documentation

For detailed information about secret usage patterns, see:

• Specification: scratchpad/secrets-yml.md
• Redaction System: actions/setup/js/redact_secrets.cjs

---

Generated: 2026-09-09 17:42 UTC
Workflow: daily-secrets-analysis workflow definition

Generated by 🔒 Daily Secrets Analysis Agent · copilot · auto · 22.8 AIC · ⌖ 8.22 AIC · ⊞ 9.5K · ◷

• expires on Sep 12, 2026, 9:46 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Daily Secrets Analysis Agent.

A newer discussion is available at Discussion #60025.