[daily secrets] Daily Secrets Analysis Report - 2026-09-16

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-09-16
Workflow Files Analyzed: 299
Run: 35129544949

📊 Executive Summary

• Total Secret References: 10,307 (secrets.*)
• GitHub Token References: 1,916 (github.token)
• Unique Secret Types: 41
• Job-Level Usage (heuristic): 1,151 (11.2%)
• Step-Level Usage (heuristic): 9,163 (88.8%)

🛡️ Security Posture

✅ Redaction System: 299/299 workflows (100%) have redaction steps
✅ Token Cascades: 1,014 instances of GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN fallback chains
✅ Permission Blocks: 299/299 workflows have explicit permissions: definitions

Automated Go test checks (pkg/workflow):

• ✅ TestCompiledLockFiles_NoGitHubEventExpressionsInRunScripts — passed. No direct github.event.* interpolation found in executable run: scripts across all lock files (template injection risk mitigated).
• ✅ TestCompiledLockFiles_NoSecretsInOutputs — passed. No secrets.* references found in job outputs or workflow_call outputs.

🎯 Key Findings

1. Token usage is dominated by GitHub auth tokens: GITHUB_TOKEN (5,348), GH_AW_GITHUB_TOKEN (4,557), and GH_AW_GITHUB_MCP_SERVER_TOKEN (1,945) together account for ~74% of all secret references — expected for a workflow-orchestration repo where nearly every job needs GitHub API access.
2. Observability secrets are consistently applied: OpenTelemetry/Sentry/Grafana secrets (GH_AW_OTEL_SENTRY_AUTHORIZATION, GH_AW_OTEL_GRAFANA_AUTHORIZATION, endpoints) appear in the several-hundred range each, indicating broad instrumentation coverage across compiled workflows.
3. 100% redaction and permission coverage: every one of the 299 lock files includes both a redaction step and an explicit permissions: block — no workflow was found running with implicit/default permissions or without secret-redaction safeguards.
4. Step-level secret usage dominates (≈89%): most secrets are referenced inside individual step env: blocks rather than job-level env:, which is the safer, more scoped pattern (limits secret exposure to the specific step that needs it).
5. No template-injection or output-leak findings: both automated Go regression tests passed cleanly, confirming no direct interpolation of github.event.* into shell scripts and no secrets leaking into job/workflow outputs.

💡 Recommendations

1. Maintain the token-cascade pattern (GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN) as the standard for all new workflows needing GitHub API access — it's already applied broadly (1,014 instances) and should stay consistent as new workflows are added.
2. Continue enforcing the two Go regression tests (TestCompiledLockFiles_NoGitHubEventExpressionsInRunScripts, TestCompiledLockFiles_NoSecretsInOutputs) as required CI gates for any PR that adds or modifies workflow markdown, since they are the primary automated defenses against template injection and secret leakage.
3. Periodically re-verify job-level vs step-level ratio (currently ~11%/89%) — a rising job-level share over time could indicate secrets being scoped more broadly than necessary and is worth a closer manual review if the trend reverses.

🔑 Top 10 Secrets by Usage

Rank	Secret Name	Occurrences	Type
1	GITHUB_TOKEN	5,348	GitHub Token
2	GH_AW_GITHUB_TOKEN	4,557	GitHub Token
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	1,945	GitHub Token
4	GH_AW_OTEL_SENTRY_AUTHORIZATION	744	Observability
5	COPILOT_GITHUB_TOKEN	527	GitHub Token
6	GH_AW_OTEL_SENTRY_ENDPOINT	497	Observability
7	GH_AW_OTEL_GRAFANA_AUTHORIZATION	495	Observability
8	OPENAI_API_KEY	398	AI Provider
9	CODEX_API_KEY	397	AI Provider
10	ANTHROPIC_API_KEY	255	AI Provider

📈 Trends

A prior daily secrets discussion (#61181, dated 2026-09-15) exists and is less than 3 days old, so it will be superseded by this report automatically rather than manually closed. Historical stat snapshots were not found on disk in this run environment, so day-over-day numeric deltas could not be computed; this report establishes a fresh baseline for future comparisons.

📖 Reference Documentation

For detailed information about secret usage patterns, see:

• Specification: scratchpad/secrets-yml.md
• Redaction System: actions/setup/js/redact_secrets.cjs

---

Generated: 2026-09-16 17:44 UTC
Workflow: .github/workflows/daily-secrets-analysis.md (see run link above)

Generated by 🔒 Daily Secrets Analysis Agent · copilot · auto · 35.4 AIC · ⌖ 6.78 AIC · ⊞ 9.6K · ◷

• expires on Sep 19, 2026, 9:47 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Daily Secrets Analysis Agent.

A newer discussion is available at Discussion #61647.