[daily secrets] Daily Secrets Analysis Report

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-10-07
Workflow Files Analyzed: 328
Run: §37661478688

📊 Executive Summary

• Total Secret References: 11,179 (secrets.*)
• GitHub Token References: 2,380 (github.token)
• Unique Secret Types: 43

🛡️ Security Posture

✅ Redaction: 328/328 workflows have redaction steps
✅ Token Cascades: 1,064 fallback chain instances
✅ Permission Blocks: 328 explicit definitions
✅ Template injection (TestCompiledLockFiles_NoGitHubEventExpressionsInRunScripts): passed
✅ Secrets in job outputs (TestCompiledLockFiles_NoSecretsInOutputs): passed

🎯 Key Findings

1. Growth: workflows 323 → 328 (+5); secret refs +61; github.token refs +338 (2,042 → 2,380).
2. No new/removed secret types (43 unchanged).
3. Cascades fell slightly (1,067 → 1,064) despite more workflows.

💡 Recommendations

1. Review why github.token references rose sharply (+338) relative to the +5 workflows.
2. Keep the CI tests above as gating checks.

🔑 Top 10 Secrets by Usage

Rank	Secret	Occurrences
1	GITHUB_TOKEN	5,719
2	GH_AW_GITHUB_TOKEN	5,174
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	2,057
4	GH_AW_OTEL_SENTRY_AUTHORIZATION	741
5	COPILOT_GITHUB_TOKEN	585
6	GH_AW_OTEL_SENTRY_ENDPOINT	495
7	GH_AW_OTEL_GRAFANA_AUTHORIZATION	493
8	OPENAI_API_KEY	271
9	CODEX_API_KEY	270

📈 Trends (vs 2026-10-06)

• Workflows: +5; secret refs: +61; token refs: +338; unique secrets: 0; redaction: +5; cascades: −3
• Job-level/step-level split not computed (heuristic grep unreliable).

---

Workflow: Daily Secrets Analysis

Generated by 🔒 Daily Secrets Analysis Agent · copilot · auto · 12.7 AIC · ⌖ 6.38 AIC · ⊞ 9.4K · ◷

• expires on Oct 10, 2026, 9:51 AM UTC-08:00