[daily secrets] Daily Secrets Analysis Report — 2026-09-21

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-09-21
Workflow Files Analyzed: 299
Run: https://github.com/github/gh-aw/actions/runs/35633417780

📊 Executive Summary

• Total Secret References: 10,307 (secrets.*)
• GitHub Token References: 1,916 (github.token)
• Unique Secret Types: 41
• Job-Level Usage: 0 (0%)
• Step-Level Usage: 4,561 (100%)

🛡️ Security Posture

✅ Redaction System: 299/299 workflows have redaction steps (100% coverage)
✅ Token Cascades: 1,014 instances of fallback chains (GH_AW_GITHUB_MCP_SERVER_TOKEN || GH_AW_GITHUB_TOKEN || GITHUB_TOKEN)
✅ Permission Blocks: 299 explicit permission definitions (1:1 with workflow count)
✅ Template Injection Check: TestCompiledLockFiles_NoGitHubEventExpressionsInRunScripts passed — no direct github.event interpolation found in run: scripts
✅ Secrets-in-Outputs Check: TestCompiledLockFiles_NoSecretsInOutputs passed — no secrets detected in job outputs

🎯 Key Findings

1. Full redaction coverage: Every compiled workflow (299/299) includes a redact_secrets step, consistent with prior days — no regressions in this control.
2. Token cascade is the dominant token pattern: GITHUB_TOKEN (5,348 refs) and GH_AW_GITHUB_TOKEN (4,557 refs) dominate usage, together accounting for ~96% of all secrets.* references, reflecting the standard fallback-chain design (GH_AW_GITHUB_MCP_SERVER_TOKEN || GH_AW_GITHUB_TOKEN || GITHUB_TOKEN, 1,014 occurrences).
3. Observability secrets are widespread but scoped: OTEL/Sentry/Grafana secrets (GH_AW_OTEL_SENTRY_AUTHORIZATION, GH_AW_OTEL_GRAFANA_AUTHORIZATION, endpoints) account for ~2,100 references, all step-level, consistent with telemetry-export patterns rather than broad job exposure.
4. All secret usage is step-level (0 job-level): no workflow currently defines secrets in a job-level env: block, which limits blast radius — secrets are only visible within the specific step that needs them.
5. No new engine-provider secret sprawl: AI-provider keys (OPENAI_API_KEY 398, CODEX_API_KEY 397, ANTHROPIC_API_KEY 255) remain proportionate to the number of workflows configured for those engines; no unexpected spikes observed.

💡 Recommendations

1. Maintain 100% redaction coverage as new workflows are added — treat any workflow missing redact_secrets as a compile-time regression to flag immediately.
2. Continue enforcing job-level env avoidance: the current 0% job-level secret usage is a strong security posture; any future PR introducing job-level secret env vars should be flagged for review since it broadens exposure to all steps in that job.
3. Monitor AI-provider key growth: as more engines/workflows are added, track OPENAI_API_KEY/CODEX_API_KEY/ANTHROPIC_API_KEY counts to ensure each corresponds to an actual configured engine and not accidental duplication.

🔑 Top 10 Secrets by Usage

Rank	Secret Name	Occurrences	Type
1	GITHUB_TOKEN	5,348	GitHub Token
2	GH_AW_GITHUB_TOKEN	4,557	GitHub Token
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	1,945	GitHub Token
4	GH_AW_OTEL_SENTRY_AUTHORIZATION	744	Observability
5	COPILOT_GITHUB_TOKEN	527	GitHub Token
6	GH_AW_OTEL_SENTRY_ENDPOINT	497	Observability
7	GH_AW_OTEL_GRAFANA_AUTHORIZATION	495	Observability
8	OPENAI_API_KEY	398	AI Provider
9	CODEX_API_KEY	397	AI Provider
10	ANTHROPIC_API_KEY	255	AI Provider

📈 Trends

Historical comparison data from previous runs was not persisted between runs in this environment, so a day-over-day delta is not available for this report. Based on the prior day's discussion (#62208, 2026-09-20), the workflow count and secret-usage patterns appear stable — no discussion of removed/added secret types was found in the previous report title/summary accessible via the GitHub API.

📖 Reference Documentation

For detailed information about secret usage patterns, see:

• Specification: scratchpad/secrets-yml.md
• Redaction System: actions/setup/js/redact_secrets.cjs

---

Generated: 2026-09-21T17:46:00Z
Workflow: https://github.com/github/gh-aw/blob/main/.github/workflows

Generated by 🔒 Daily Secrets Analysis Agent · copilot · auto · 31.6 AIC · ⌖ 7.39 AIC · ⊞ 9.2K · ◷

• expires on Sep 24, 2026, 9:46 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Daily Secrets Analysis Agent.

A newer discussion is available at Discussion #62713.