[daily secrets] Daily Secrets Analysis Report

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-08-08
Workflow Files Analyzed: 283
Run: §31270205813

📊 Executive Summary

• Total Secret References: 9,661 (secrets.*)
• GitHub Token References: 2,107 (github.token)
• Unique Secret Types: 44
• Redaction Coverage: 283/283 workflows (100%)

🛡️ Security Posture

✅ Redaction System: 283/283 workflows have redact_secrets steps (100% coverage)
✅ Token Cascades: 1,009 instances of GH_AW_GITHUB_MCP_SERVER_TOKEN || GH_AW_GITHUB_TOKEN || GITHUB_TOKEN fallback chains
✅ Permission Blocks: 283 explicit permissions: blocks (1 per workflow — least-privilege scoping enforced)
✅ Secrets in Outputs: 0 direct secret leakage into job outputs: blocks detected (37 matches were adjacent steps.*.outputs.* lines unrelated to secret exposure — false positive from broad grep, manually verified no secrets.* values feed into outputs:)
⚠️ github.event.* Interpolation: 5,242 direct references found, mostly in GH_AW_EXPR_* sanitized intermediate env vars (compiler's standard pattern of hoisting event context into env vars before use — not raw template injection, as these are assigned to env vars rather than interpolated directly into run: scripts)

🎯 Key Findings

1. GITHUB_TOKEN dominates usage (4,960 refs, ~51% of all secret references), reflecting its role as the universal fallback in nearly every workflow's token cascade.
2. GH_AW_GITHUB_TOKEN (4,271) and GH_AW_GITHUB_MCP_SERVER_TOKEN (1,857) are the next most common — consistent with the standard 3-tier token cascade pattern used across all 283 workflows.
3. Observability secrets (GH_AW_OTEL_SENTRY_*, GH_AW_OTEL_GRAFANA_*) collectively account for ~1,952 references, indicating broad OTLP telemetry instrumentation across the fleet.
4. AI provider keys (ANTHROPIC_API_KEY: 264, OPENAI_API_KEY: 107, CODEX_API_KEY: 106) show Anthropic/Claude as the predominant engine choice.
5. 100% redaction and permission-block coverage confirms consistent application of the compiler's baseline security template across the entire workflow fleet — no workflow was found missing these controls.

💡 Recommendations

1. Monitor cascade consistency: Periodically verify all 283 workflows use the full 3-tier token cascade (MCP_SERVER_TOKEN || GH_AW_GITHUB_TOKEN || GITHUB_TOKEN) rather than partial chains, to avoid silent permission downgrades.
2. Audit GH_AW_EXPR_* hoisting: Continue the current practice of assigning github.event.* expressions to intermediate GH_AW_EXPR_* env vars rather than inline run: interpolation — this is already the dominant pattern and should remain the enforced compiler behavior.
3. Track OTEL secret sprawl: With ~1,952 references to observability secrets, consider consolidating Sentry/Grafana auth headers into fewer shared secrets if the number of distinct telemetry backends grows further.

🔑 Top 10 Secrets by Usage

Rank	Secret Name	Occurrences	Type
1	GITHUB_TOKEN	4,960	GitHub Token
2	GH_AW_GITHUB_TOKEN	4,271	GitHub Token
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	1,857	GitHub Token
4	COPILOT_GITHUB_TOKEN	742	GitHub Token
5	GH_AW_OTEL_SENTRY_AUTHORIZATION	732	Observability
6	GH_AW_OTEL_SENTRY_ENDPOINT	489	Observability
7	GH_AW_OTEL_GRAFANA_AUTHORIZATION	487	Observability
8	ANTHROPIC_API_KEY	264	AI Provider Key
9	GH_AW_OTEL_GRAFANA_ENDPOINT	244	Observability
10	DOCKER_USERNAME / DOCKER_PAT	112 each	Registry Credential

📈 Trends

No historical baseline was found for prior daily-secrets discussions in this repository, so this is the first recorded baseline. Future runs will compare against these figures:

{
  "date": "2026-08-08",
  "total_workflows": 283,
  "secret_refs": 9661,
  "token_refs": 2107,
  "unique_secrets": 44,
  "redaction_count": 283,
  "cascade_count": 1009,
  "permission_blocks": 283
}

📖 Reference Documentation

For detailed information about secret usage patterns, see:

• Specification: scratchpad/secrets-yml.md
• Redaction System: actions/setup/js/redact_secrets.cjs

---

Generated: 2026-08-08 17:48 UTC
Workflow: daily-secrets-analysis.md

Generated by 🔒 Daily Secrets Analysis Agent · auto · 16.4 AIC · ⌖ 2.72 AIC · ⊞ 9.1K · ◷

• expires on Aug 11, 2026, 9:49 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Daily Secrets Analysis Agent.

A newer discussion is available at Discussion #51620.