[daily secrets] Daily Secrets Analysis Report — 2026-09-20

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-09-20
Workflow Files Analyzed: 299
Run: 35526539766

📊 Executive Summary

• Total Secret References: 10,307 (secrets.*) — unchanged from 2026-09-19
• GitHub Token References: 1,916 (github.token) — unchanged from 2026-09-19
• Unique Secret Types: 42 (identical to 2026-09-19)
• Job-Level Usage: 0 (0%)
• Step-Level Usage: 4,561 (100%)

Note: the job/step split uses a line-proximity heuristic (grep windows around - name: / block headers), not an AST-level parse. The 0% job-level figure likely reflects the heuristic's limits rather than a literal absence of job-level secret usage — treat it as directional, not authoritative (see recommendation below, carried over from prior reports).

🛡️ Security Posture

✅ Redaction System: 299/299 workflows have redaction steps (100% coverage)
✅ Token Cascades: 1,014 instances of fallback chains (GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN)
✅ Permission Blocks: 299 explicit permissions: definitions (one per workflow)

Deterministic Go test checks (source of truth, not grep heuristics):

• ✅ TestCompiledLockFiles_NoGitHubEventExpressionsInRunScripts — PASS. No direct github.event.* interpolation found in executable run: scripts across compiled lock files (template injection risk check).
• ✅ TestCompiledLockFiles_NoSecretsInOutputs — PASS. No secrets.* values detected in job outputs or workflow_call outputs.

🎯 Key Findings

1. No change day-over-day: Every headline metric (total secret refs, token refs, unique secret types, redaction coverage, cascade count, permission blocks) is byte-for-byte identical to the 2026-09-19 report, indicating no new workflows, secrets, or structural changes were introduced to compiled lock files in the last 24 hours.
2. Universal redaction coverage maintained: All 299 compiled workflows continue to include a redact_secrets step — no regressions.
3. GitHub token dominance persists: GITHUB_TOKEN (5,348) and GH_AW_GITHUB_TOKEN (4,557) together account for ~96% of all secret references; GH_AW_GITHUB_MCP_SERVER_TOKEN (1,945) remains the third largest, tied to MCP server auth.
4. No security violations detected: Both automated Go-based checks (template injection, secret-in-outputs) passed cleanly again this run.

💡 Recommendations

1. Improve structural analysis tooling (carried over): Replace the line-proximity grep heuristic for job-level vs. step-level secret classification with a Go-based AST test, similar to the existing injection/output checks, for trustworthy trend tracking.
2. Continue monitoring for drift: Since metrics are stable, focus future runs on detecting deltas (new secret types, new workflows, changes in cascade/redaction coverage) rather than re-deriving static totals every day.
3. No immediate action required: Given zero change and clean security checks, no remediation is needed today.

🔑 Top 10 Secrets by Usage

Rank	Secret Name	Occurrences	Type
1	GITHUB_TOKEN	5,348	GitHub Token
2	GH_AW_GITHUB_TOKEN	4,557	GitHub Token
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	1,945	GitHub Token (MCP)
4	GH_AW_OTEL_SENTRY_AUTHORIZATION	744	Observability
5	COPILOT_GITHUB_TOKEN	527	GitHub Token
6	GH_AW_OTEL_SENTRY_ENDPOINT	497	Observability
7	GH_AW_OTEL_GRAFANA_AUTHORIZATION	495	Observability
8	OPENAI_API_KEY	398	LLM Provider
9	CODEX_API_KEY	397	LLM Provider
10	ANTHROPIC_API_KEY	255	LLM Provider

📈 Trends

Compared to the 2026-09-19 report:

• Secret references: no change (10,307 → 10,307)
• Token references: no change (1,916 → 1,916)
• Unique secret types: no change (42 → 42)
• Redaction coverage: no change (299/299 → 299/299, 100%)
• Token cascade usages: no change (1,014 → 1,014)
• New secret types: none observed
• Removed secrets: none observed

📖 Reference Documentation

For detailed information about secret usage patterns, see:

• Specification: scratchpad/secrets-yml.md
• Redaction System: actions/setup/js/redact_secrets.cjs

---

Generated: 2026-09-20 17:43 UTC
Workflow: .github/workflows/daily-secrets-analysis.md

Generated by 🔒 Daily Secrets Analysis Agent · copilot · auto · 33.2 AIC · ⌖ 10.9 AIC · ⊞ 9.2K · ◷

• expires on Sep 23, 2026, 9:46 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Daily Secrets Analysis Agent.

A newer discussion is available at Discussion #62409.