[daily secrets] Daily Secrets Analysis Report - 2026-09-28

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-09-28
Workflow Files Analyzed: 298
Run: https://github.com/github/gh-aw/actions/runs/36459894785

📊 Executive Summary

• Total Secret References: 10,274 (secrets.*)
• GitHub Token References: 1,919 (github.token)
• Unique Secret Types: 42
• Job-Level Usage: 0 references detected directly in job-level env: blocks
• Step-Level Usage: 4,544 references (GH_AW_GITHUB_TOKEN alone) confirm secrets are consumed almost exclusively at the step level (inside run:/with: blocks, ~44.2% of all secret references), consistent with the compiler's per-step secret injection pattern

🛡️ Security Posture

• ✅ Redaction System: 298/298 workflows have redaction steps (100% coverage)
• ✅ Token Cascades: 1,011 instances of the GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN fallback chain
• ✅ Permission Blocks: 298 explicit permissions: definitions (1 per workflow, 100% coverage)
• ✅ Template Injection Check: TestCompiledLockFiles_NoGitHubEventExpressionsInRunScripts passed — no direct github.event.* interpolation found in run: scripts
• ✅ Secrets-in-Outputs Check: TestCompiledLockFiles_NoSecretsInOutputs passed — no secrets found in job outputs

🎯 Key Findings

1. Universal redaction and permission coverage maintained: All 298 compiled workflows (unchanged fleet size from yesterday) still include both a secret-redaction step and an explicit permissions: block, with zero regressions.
2. Secret reference volume is completely flat: 10,274 total secrets.* references today, identical to yesterday's 10,274 — no net change, indicating no new secret-consuming workflow logic was merged.
3. Unique secret type count dropped by one (43 → 42), reversing yesterday's incremental growth. This suggests a low-frequency, scoped secret reference was removed or a workflow using it was deleted/consolidated rather than any broad security-relevant change.
4. GitHub token usage still dominates: GITHUB_TOKEN (5,324) and GH_AW_GITHUB_TOKEN (4,543) together account for ~96% of all secret references, reflecting the consistent fallback-cascade pattern used across MCP server and CLI tooling integration points (1,011 cascade instances, unchanged from yesterday).
5. No anomalies detected: Both automated Go tests (template-injection and secrets-in-outputs) passed cleanly with zero flagged workflows — the same clean result as the prior report.

💡 Recommendations

1. Keep the 100% redaction/permissions coverage as a hard CI gate. The metric has now held steady across at least three consecutive days; formalizing it (fail compilation if a new .lock.yml lacks either control) would lock in the current baseline.
2. Investigate the -1 unique secret type delta to confirm it reflects an intentional cleanup (e.g., removal of an unused low-frequency secret or workflow) rather than an accidental loss of a still-needed credential reference.
3. Continue day-over-day trend tracking — persist secrets-stats.json as a workflow artifact so future runs can compute deltas without re-scraping prior discussion bodies.

🔑 Top 15 Secrets by Usage

Rank	Secret Name	Occurrences	Type
1	GITHUB_TOKEN	5324	GitHub Token
2	GH_AW_GITHUB_TOKEN	4543	GitHub Token
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	1939	GitHub Token (MCP)
4	GH_AW_OTEL_SENTRY_AUTHORIZATION	741	Observability
5	COPILOT_GITHUB_TOKEN	520	GitHub Token
6	GH_AW_OTEL_SENTRY_ENDPOINT	495	Observability
7	GH_AW_OTEL_GRAFANA_AUTHORIZATION	493	Observability
8	OPENAI_API_KEY	398	AI Engine
9	CODEX_API_KEY	397	AI Engine
10	ANTHROPIC_API_KEY	255	AI Engine
11	GH_AW_OTEL_GRAFANA_ENDPOINT	247	Observability
12	GH_AW_DEFAULT_OTLP_HEADERS	102	Observability
13	GH_AW_DEFAULT_OTLP_ENDPOINT	102	Observability
14	GH_AW_CI_TRIGGER_TOKEN	70	CI/Automation
15	GH_AW_SIDE_REPO_PAT	24	Repository Access

📈 Trends (vs. 2026-09-27 report, #63858)

Metric	2026-09-27	2026-09-28	Δ
Total workflows	298	298	0
Total secret refs	10,274	10,274	0
GitHub token refs	1,919	1,919	0
Unique secret types	43	42	-1
Redaction coverage	298/298	298/298	0
Token cascade instances	1,011	1,011	0
Permission blocks	298	298	0

Top-3 secrets are unchanged in rank and count (GITHUB_TOKEN 5324, GH_AW_GITHUB_TOKEN 4543, GH_AW_GITHUB_MCP_SERVER_TOKEN 1939). The -1 net unique secret type observed today has no visible impact on the security posture checks and the overall reference volume is unchanged, suggesting a low-frequency secret name simply dropped out of the current scan (e.g., a workflow removal or consolidation) rather than a security regression.

📖 Reference Documentation

For detailed information about secret usage patterns, see:

• Specification: scratchpad/secrets-yml.md
• Redaction System: actions/setup/js/redact_secrets.cjs

---

Generated: 2026-09-28T17:51:07Z
Workflow: .github/workflows/daily-secrets-analysis.md

Generated by 🔒 Daily Secrets Analysis Agent · copilot · auto · 34.3 AIC · ⌖ 12.2 AIC · ⊞ 9.1K · ◷

• expires on Oct 1, 2026, 9:59 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Daily Secrets Analysis Agent.

A newer discussion is available at Discussion #64309.