[daily secrets] Daily Secrets Analysis Report - 2026-09-26

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-09-26
Workflow Files Analyzed: 298
Run: https://github.com/github/gh-aw/actions/runs/36259777914

📊 Executive Summary

• Total Secret References: 10,269 (secrets.*)
• GitHub Token References: 1,919 (github.token)
• Unique Secret Types: 42
• Workflows with GITHUB_TOKEN: GITHUB_TOKEN 51.9% of all secret refs, GH_AW_GITHUB_TOKEN 44.2%

🛡️ Security Posture

• ✅ Redaction System: 298/298 workflows have redaction steps (100% coverage)
• ✅ Token Cascades: 1,011 instances of the GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN fallback chain
• ✅ Permission Blocks: 298 explicit permissions: definitions (1 per workflow, 100% coverage)
• ✅ Template Injection Check: TestCompiledLockFiles_NoGitHubEventExpressionsInRunScripts passed — no direct github.event.* interpolation found in run: scripts
• ✅ Secrets-in-Outputs Check: TestCompiledLockFiles_NoSecretsInOutputs passed — no secrets found in job outputs

🎯 Key Findings

1. Universal redaction and permission coverage: All 298 compiled workflows include both a secret-redaction step and an explicit permissions: block — a strong baseline security posture with no gaps.
2. GitHub token usage dominates: GITHUB_TOKEN and GH_AW_GITHUB_TOKEN together account for ~96% of all secret references, reflecting the fallback-cascade pattern (GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN) used consistently across the MCP server and CLI tooling integration points (1,011 cascade instances).
3. AI-engine credentials are broadly but not universally adopted: OPENAI_API_KEY (64 workflows), CODEX_API_KEY (63 workflows), and ANTHROPIC_API_KEY (56 workflows) appear in roughly a fifth of all workflows each, consistent with multi-engine support (Codex, Claude, custom) rather than every workflow needing every engine's key.
4. Observability secrets are present but scoped: OpenTelemetry-related secrets (Sentry auth/endpoint, Grafana auth/endpoint, default OTLP headers/endpoint) total ~2,180 references, indicating consistent instrumentation across workflows without overexposure (no OTLP secret appears in job outputs per Step 6 checks).
5. No anomalies detected: Both automated Go tests (template-injection and secrets-in-outputs) passed cleanly with zero flagged workflows.

💡 Recommendations

1. Maintain the 100% redaction/permissions coverage as a regression gate — consider adding a CI assertion that fails compilation if a new .lock.yml lacks either control, so the current strong baseline can't silently erode.
2. Continue tracking day-over-day secret-reference deltas. This is the first day stats have been captured for comparison (no prior secrets-stats.json was found); tomorrow's report will be the first with trend data — watch especially for sudden growth in unique secret types, which could indicate scope creep in what workflows are permitted to access.

🔑 Top 15 Secrets by Usage

Rank	Secret Name	Occurrences	Type
1	GITHUB_TOKEN	5325	GitHub Token
2	GH_AW_GITHUB_TOKEN	4544	GitHub Token
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	1939	GitHub Token (MCP)
4	GH_AW_OTEL_SENTRY_AUTHORIZATION	741	Observability
5	COPILOT_GITHUB_TOKEN	520	GitHub Token
6	GH_AW_OTEL_SENTRY_ENDPOINT	495	Observability
7	GH_AW_OTEL_GRAFANA_AUTHORIZATION	493	Observability
8	OPENAI_API_KEY	398	AI Engine
9	CODEX_API_KEY	397	AI Engine
10	ANTHROPIC_API_KEY	255	AI Engine
11	GH_AW_OTEL_GRAFANA_ENDPOINT	247	Observability
12	GH_AW_DEFAULT_OTLP_HEADERS	102	Observability
13	GH_AW_DEFAULT_OTLP_ENDPOINT	102	Observability
14	GH_AW_CI_TRIGGER_TOKEN	70	CI/Automation
15	GH_AW_SIDE_REPO_PAT	24	Repository Access

📈 Trends

No historical secrets-stats.json was found in this run's environment — this is treated as the baseline day. Tomorrow's report will include day-over-day deltas for total secret references, unique secret types, and any newly introduced or removed secrets.

📖 Reference Documentation

For detailed information about secret usage patterns, see:

• Specification: scratchpad/secrets-yml.md
• Redaction System: actions/setup/js/redact_secrets.cjs

---

Generated: 2026-09-26T17:41:03Z
Workflow: .github/workflows/daily-secrets-analysis.md

Generated by 🔒 Daily Secrets Analysis Agent · copilot · auto · 26.1 AIC · ⌖ 7.11 AIC · ⊞ 9.1K · ◷

• expires on Sep 29, 2026, 9:48 AM UTC-08:00