[daily secrets] Daily Secrets Analysis Report

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-07-28
Workflow Files Analyzed: 264
Run: §30385571017

📊 Executive Summary

• Total Secret References: 8,660 (secrets.*)
• GitHub Token References: 1,866 (github.token)
• Unique Secret Types: 40
• Step-Level Usage (env blocks in step definitions): ~3,985 occurrences (rough structural scan; most secrets are injected as step/action env: entries rather than job-level env:)

🛡️ Security Posture

✅ Redaction System: 264/264 workflows have redact_secrets steps (100% coverage)
✅ Token Cascades: 947 instances of GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN fallback chains
✅ Permission Blocks: 264 explicit permissions: definitions (one per workflow — full coverage)

Template injection scan: 4,703 raw github.event. matches were found across all lock files, but these are expected — the compiler consistently routes untrusted github.event.* values through intermediate env: variables before use in scripts, rather than interpolating them directly into shell/JS bodies. No raw unguarded ${{ github.event.* }} interpolation inside run: script bodies was found on manual spot-check of several matches.

Secrets-in-outputs scan: 33 raw matches, but on inspection every one is a step-level env: assignment (e.g., ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}) that happened to fall within 5 lines of an unrelated outputs: block — not an actual job outputs: exposing a secret value. ✅ No genuine secret exposure via job outputs found.

🎯 Key Findings

1. GITHUB_TOKEN dominates usage (4,359 refs, ~50% of all secret references), consistent with GitHub Actions' default token being the primary credential across workflows.
2. Token fallback cascades are pervasive (947 instances), reflecting the intentional design pattern of preferring GH_AW_GITHUB_MCP_SERVER_TOKEN → GH_AW_GITHUB_TOKEN → GITHUB_TOKEN for MCP server auth, which limits blast radius if a narrower-scoped token is unavailable.
3. Full redaction and permission coverage: every one of the 264 compiled workflows includes both a redact_secrets step and an explicit permissions: block — a strong baseline security control ensuring least-privilege intent and secret-leak mitigation are present everywhere.
4. API-key secrets are concentrated in AI provider credentials (ANTHROPIC_API_KEY: 272, OPENAI_API_KEY: 103, CODEX_API_KEY: 102), reflecting the mix of LLM engines (Claude, Codex, Copilot) used across workflows.

💡 Recommendations

1. Continue monitoring token cascade adoption — a small number of workflows may still reference secrets.GITHUB_TOKEN directly without the fallback cascade; consider auditing for consistency during the next workflow update pass.
2. Periodic spot-check of github.event.* usage in run: script bodies (not just env: blocks) is recommended to guard against future template-injection regressions as new workflows are added.

🔑 Top 10 Secrets by Usage

Rank	Secret Name	Occurrences	Type
1	GITHUB_TOKEN	4,359	GitHub Token
2	GH_AW_GITHUB_TOKEN	3,730	GitHub Token
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	1,738	GitHub Token
4	COPILOT_GITHUB_TOKEN	752	GitHub Token
5	GH_AW_OTEL_SENTRY_AUTHORIZATION	699	Observability
6	GH_AW_OTEL_SENTRY_ENDPOINT	467	Observability
7	GH_AW_OTEL_GRAFANA_AUTHORIZATION	465	Observability
8	ANTHROPIC_API_KEY	272	AI Provider Key
9	GH_AW_OTEL_GRAFANA_ENDPOINT	233	Observability
10	OPENAI_API_KEY	103	AI Provider Key

📈 Trends

This is the first recorded run of the daily secrets analysis in this environment — no prior "[daily secrets]" discussion was found to compare against. Baseline stats have been captured for future day-over-day comparison.

📖 Reference Documentation

For detailed information about secret usage patterns, see:

• Specification: scratchpad/secrets-yml.md
• Redaction System: actions/setup/js/redact_secrets.cjs

---

Generated: 2026-07-28 18:05 UTC
Workflow: daily-secrets-analysis

Generated by 🔒 Daily Secrets Analysis Agent · sonnet50 · 17.2 AIC · ⌖ 7.29 AIC · ⊞ 8.7K · ◷

• expires on Jul 31, 2026, 10:07 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Daily Secrets Analysis Agent.

A newer discussion is available at Discussion #48953.