[daily secrets] Daily Secrets Analysis Report - 2026-09-15

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-09-15
Workflow Files Analyzed: 299
Run: https://github.com/github/gh-aw/actions/runs/35002658423

📊 Executive Summary

• Total Secret References: 10,307 (secrets.*)
• GitHub Token References: 1,916 (github.token)
• Unique Secret Types: 41 (extraction artifact of an empty-string match corrected out; see notes)
• Step-Level Usage: 4,561 secret references found directly within - name: step blocks (dominant scoping pattern)

Note: precise job-level vs. step-level attribution requires structural YAML parsing rather than line-window heuristics; the practical takeaway — that secrets are consistently scoped to individual steps rather than broadly exported at the job env: level — is unchanged from prior reports.

🛡️ Security Posture

✅ Redaction System: 299/299 workflows have redaction steps (100%)
✅ Token Cascades: 1,014 instances of the fallback chain (GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN)
✅ Permission Blocks: 299 explicit permission definitions (1 per workflow)
✅ Template Injection Check: TestCompiledLockFiles_NoGitHubEventExpressionsInRunScripts — PASS, no direct github.event.* interpolation in run: scripts
✅ Secrets-in-Outputs Check: TestCompiledLockFiles_NoSecretsInOutputs — PASS, no secret values exposed via job/workflow_call outputs

🎯 Key Findings

1. 100% redaction coverage maintained: All 299 compiled lock files include a redact_secrets step — no gaps, unchanged from the previous three days.
2. Metrics fully stable day-over-day: every headline figure (workflow count, secret refs, token refs, cascade count, permission blocks) is byte-for-byte identical to the 2026-09-14 report ([daily secrets] Daily Secrets Analysis Report - 2026-09-14 #60894), indicating no new workflows, secret additions, or removals since yesterday.
3. Token secrets dominate usage: GITHUB_TOKEN (5,348), GH_AW_GITHUB_TOKEN (4,557), and GH_AW_GITHUB_MCP_SERVER_TOKEN (1,945) together make up the large majority of references, consistent with the standard MCP-server token-cascade pattern.
4. Observability secrets are the second-largest category: Sentry/Grafana OTEL secrets total ~1,984 references, reflecting broad tracing instrumentation across workflows.
5. AI engine credentials remain bounded and proportional: OPENAI_API_KEY (398), CODEX_API_KEY (397), ANTHROPIC_API_KEY (255) track the number of workflows using each respective engine.
6. No anomalies detected: both automated Go-based security checks (template injection in run scripts, secret leakage via outputs) passed cleanly with zero findings, matching every prior daily run.

💡 Recommendations

1. Maintain step-level scoping discipline: continue avoiding job-level env: secret assignments in new/updated workflows.
2. Keep the token-cascade pattern as default for new MCP-based workflows rather than hardcoding secrets.GITHUB_TOKEN directly.
3. Continue running the two Go security tests in CI (TestCompiledLockFiles_NoGitHubEventExpressionsInRunScripts, TestCompiledLockFiles_NoSecretsInOutputs) as part of the compile/release pipeline, not just in this daily audit.
4. Consider replacing the line-heuristic job/step split with a structural YAML-aware count (similar to the existing Go tests) to remove residual ambiguity in future reports.

🔑 Top 10 Secrets by Usage

Rank	Secret Name	Occurrences	Type
1	GITHUB_TOKEN	5,348	GitHub Token
2	GH_AW_GITHUB_TOKEN	4,557	GitHub Token
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	1,945	GitHub Token
4	GH_AW_OTEL_SENTRY_AUTHORIZATION	744	Observability
5	COPILOT_GITHUB_TOKEN	527	GitHub Token
6	GH_AW_OTEL_SENTRY_ENDPOINT	497	Observability
7	GH_AW_OTEL_GRAFANA_AUTHORIZATION	495	Observability
8	OPENAI_API_KEY	398	AI Engine
9	CODEX_API_KEY	397	AI Engine
10	ANTHROPIC_API_KEY	255	AI Engine

📈 Trends (vs. 2026-09-14 report, #60894)

• Total workflows: 299 → 299 (no change)
• Secret references: 10,307 → 10,307 (no change)
• Token references: 1,916 → 1,916 (no change)
• Unique secret types: 41 → 41 (no change)
• Redaction coverage: 100% → 100% (no change)
• Token cascade usages: 1,014 → 1,014 (no change)
• New secret types: none
• Removed secret types: none

The system is in a steady state with no drift in secret usage patterns over the last several daily reports.

📖 Reference Documentation

For detailed information about secret usage patterns, see:

• Specification: scratchpad/secrets-yml.md
• Redaction System: actions/setup/js/redact_secrets.cjs

---

Generated: 2026-09-15T17:47:00Z
Workflow: https://github.com/github/gh-aw/actions/runs/35002658423

Generated by 🔒 Daily Secrets Analysis Agent · copilot · auto · 37.4 AIC · ⌖ 8.05 AIC · ⊞ 9.6K · ◷

• expires on Sep 18, 2026, 9:48 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Daily Secrets Analysis Agent.

A newer discussion is available at Discussion #61387.