[daily secrets] Daily Secrets Analysis Report - 2026-09-10

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-09-10
Workflow Files Analyzed: 299
Run: 34509526676

📊 Executive Summary

• Total Secret References: 10,253 (secrets.*)
• GitHub Token References: 2,214 (github.token)
• Unique Secret Types: 40
• Job-Level Usage: 0 (0.0%)
• Step-Level Usage: 4,558 (100.0%) — note: the job/step split uses a line-proximity heuristic and likely undercounts job-level env: blocks; treat this figure as directional only, not authoritative.

🛡️ Security Posture

✅ Redaction System: 299/299 workflows have redaction steps (100% coverage)
✅ Token Cascades: 1,014 instances of fallback chains (GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN)
✅ Permission Blocks: 299 explicit permissions: definitions (1 per workflow — full coverage)

Deterministic Go test checks (pkg/workflow):

• ✅ TestCompiledLockFiles_NoGitHubEventExpressionsInRunScripts — PASS: no direct github.event.* interpolation found in executable run: scripts across all compiled workflows (template injection risk check).
• ✅ TestCompiledLockFiles_NoSecretsInOutputs — PASS: no secrets detected in job outputs or workflow_call outputs.

🎯 Key Findings

1. Full redaction and permission coverage: All 299 compiled .lock.yml files include a redaction step and an explicit permissions: block — no workflow is running with implicit/default permissions.
2. GITHUB_TOKEN and GH_AW_GITHUB_TOKEN dominate usage: together they account for ~97% of all secrets.* references (5,348 + 4,557 of 10,253), consistent with the standard token-cascade pattern used for GitHub API access.
3. Observability secrets are widespread but scoped: OTEL/Sentry/Grafana/Datadog credentials (GH_AW_OTEL_*) appear in a few hundred workflows each, all following the GH_AW_ naming convention rather than raw provider secret names — good namespacing hygiene.
4. No anomalous or unexpected secret names: all 40 unique secret identifiers match established naming conventions (GH_AW_* custom secrets, standard vendor API keys like OPENAI_API_KEY/ANTHROPIC_API_KEY/CODEX_API_KEY, and GitHub tokens). No signs of ad hoc or leaked-looking secret names.
5. No historical baseline available: this is the first "[daily secrets]" discussion in this repository, so no day-over-day trend comparison could be performed yet. Tomorrow's run will be the first with a comparable baseline.

💡 Recommendations

1. Refine job vs. step-level accounting: replace the current line-proximity grep heuristic with a structured YAML-aware count (similar to the Go tests used for template-injection/output checks) to get an accurate job-level vs. step-level secret usage breakdown.
2. Continue enforcing the two deterministic Go security tests (NoGitHubEventExpressionsInRunScripts, NoSecretsInOutputs) as CI gates on every compile — both passed cleanly today and should remain required checks.
3. Persist historical stats (e.g., as a discussion or artifact) across runs so future daily reports can surface real secret-usage trend deltas instead of only point-in-time snapshots.

🔑 Top 15 Secrets by Usage

Rank	Secret Name	Occurrences	Type
1	GITHUB_TOKEN	5,348	GitHub Token
2	GH_AW_GITHUB_TOKEN	4,557	GitHub Token
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	1,945	GitHub Token
4	GH_AW_OTEL_SENTRY_AUTHORIZATION	744	Observability
5	COPILOT_GITHUB_TOKEN	527	GitHub Token
6	GH_AW_OTEL_SENTRY_ENDPOINT	497	Observability
7	GH_AW_OTEL_GRAFANA_AUTHORIZATION	495	Observability
8	OPENAI_API_KEY	398	AI Provider
9	CODEX_API_KEY	397	AI Provider
10	ANTHROPIC_API_KEY	255	AI Provider
11	GH_AW_OTEL_GRAFANA_ENDPOINT	248	Observability
12	GH_AW_DEFAULT_OTLP_HEADERS	102	Observability
13	GH_AW_CI_TRIGGER_TOKEN	70	GitHub Token
14	GH_AW_SIDE_REPO_PAT	24	GitHub Token

📈 Trends

No historical data available yet — this is the first "[daily secrets]" discussion generated in this repository. Starting with today's run, statistics will be persisted so future reports can show day-over-day deltas (new secret references, removed secrets, cascade pattern changes, etc.).

📖 Reference Documentation

For detailed information about secret usage patterns, see:

• Specification: scratchpad/secrets-yml.md
• Redaction System: actions/setup/js/redact_secrets.cjs

---

Generated: 2026-09-10 17:43 UTC
Workflow: daily-secrets-analysis

Generated by 🔒 Daily Secrets Analysis Agent · copilot · auto · 29.7 AIC · ⌖ 7.24 AIC · ⊞ 9.5K · ◷

• expires on Sep 13, 2026, 9:45 AM UTC-08:00