[daily secrets] Daily Secrets Analysis Report — 2026-09-22

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-09-22
Workflow Files Analyzed: 299
Run: https://github.com/github/gh-aw/actions/runs/35762058057

📊 Executive Summary

• Total Secret References: 10,311 (secrets.*)
• GitHub Token References: 1,917 (github.token)
• Unique Secret Types: 41
• Job-Level Usage: 0 (0%)
• Step-Level Usage: 4,563 (100%)

🛡️ Security Posture

✅ Redaction System: 299/299 workflows have redaction steps (100% coverage)
✅ Token Cascades: 1,015 instances of fallback chains (GH_AW_GITHUB_MCP_SERVER_TOKEN || GH_AW_GITHUB_TOKEN || GITHUB_TOKEN)
✅ Permission Blocks: 299 explicit permission definitions (1:1 with workflow count)
✅ Template Injection Check: TestCompiledLockFiles_NoGitHubEventExpressionsInRunScripts passed — no direct github.event interpolation found in run: scripts
✅ Secrets-in-Outputs Check: TestCompiledLockFiles_NoSecretsInOutputs passed — no secrets detected in job outputs

🎯 Key Findings

1. Full redaction coverage maintained: All 299/299 compiled workflows still include a redact_secrets step — no regression from yesterday's report ([daily secrets] Daily Secrets Analysis Report — 2026-09-21 #62409, 2026-09-21).
2. Token usage grew marginally: GITHUB_TOKEN rose from 5,348 → 5,350 (+2), GH_AW_GITHUB_TOKEN from 4,557 → 4,560 (+3), and GH_AW_GITHUB_MCP_SERVER_TOKEN from 1,945 → 1,946 (+1). These small increases are consistent with routine workflow edits rather than any structural change.
3. COPILOT_GITHUB_TOKEN usage decreased from 527 → 525 (−2), likely reflecting a minor workflow consolidation or reconfiguration; no other engine-token counts moved.
4. Zero job-level secret exposure persists: 0% of secret usage is at job-level env: blocks (100% step-level), keeping the blast radius of any single secret minimized to the step that consumes it — unchanged from prior days.
5. No new or removed secret types: unique secret type count remains 41, matching yesterday's report; no evidence of secret sprawl or orphaned/unused secret removal.

💡 Recommendations

1. Continue treating missing redact_secrets steps as a compile-time regression — coverage has held at 100% for at least the last 5 days; keep this as a CI gate.
2. Maintain the 0% job-level secret policy: flag any future PR that introduces job-level secret env: blocks for security review, since it would broaden secret visibility to all steps in that job.
3. Investigate the COPILOT_GITHUB_TOKEN count decrease (527 → 525) to confirm it corresponds to an intentional workflow change (e.g., a workflow removal or migration to GH_AW_GITHUB_TOKEN) rather than a broken reference.
4. Keep monitoring AI-provider key counts (OPENAI_API_KEY 398, CODEX_API_KEY 397, ANTHROPIC_API_KEY 255 — unchanged from yesterday) as new engines/workflows are onboarded.

🔑 Top 10 Secrets by Usage

Rank	Secret Name	Occurrences	Type
1	GITHUB_TOKEN	5,350	GitHub Token
2	GH_AW_GITHUB_TOKEN	4,560	GitHub Token
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	1,946	GitHub Token
4	GH_AW_OTEL_SENTRY_AUTHORIZATION	744	Observability
5	COPILOT_GITHUB_TOKEN	525	GitHub Token
6	GH_AW_OTEL_SENTRY_ENDPOINT	497	Observability
7	GH_AW_OTEL_GRAFANA_AUTHORIZATION	495	Observability
8	OPENAI_API_KEY	398	AI Provider
9	CODEX_API_KEY	397	AI Provider
10	ANTHROPIC_API_KEY	255	AI Provider

📈 Trends (vs. 2026-09-21, discussion #62409)

Metric	2026-09-21	2026-09-22	Δ
Total workflows	299	299	0
Secret refs (secrets.*)	10,307	10,311	+4
github.token refs	1,916	1,917	+1
Unique secret types	41	41	0
Token cascades	1,014	1,015	+1
GITHUB_TOKEN	5,348	5,350	+2
GH_AW_GITHUB_TOKEN	4,557	4,560	+3
GH_AW_GITHUB_MCP_SERVER_TOKEN	1,945	1,946	+1
COPILOT_GITHUB_TOKEN	527	525	−2

No new secret types added; no secret types removed. Changes are minor and consistent with routine workflow edits.

📖 Reference Documentation

For detailed information about secret usage patterns, see:

• Specification: scratchpad/secrets-yml.md
• Redaction System: actions/setup/js/redact_secrets.cjs

---

Generated: 2026-09-22T17:42:21Z
Workflow: https://github.com/github/gh-aw/blob/main/.github/workflows

Generated by 🔒 Daily Secrets Analysis Agent · copilot · auto · 33.8 AIC · ⌖ 9.08 AIC · ⊞ 9.2K · ◷

• expires on Sep 25, 2026, 9:47 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Daily Secrets Analysis Agent.

A newer discussion is available at Discussion #62996.