[daily secrets] Daily Secrets Analysis Report - 2026-11-08

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Report date (UTC): 2026-11-08
Workflow files analyzed: 365 .lock.yml files
Checkout: HEAD 866dfdb (committed 2026-11-12T10:52:17Z). The checkout is shallow and has no 2026-11-08 commit, so counts reflect this checkout, not the report date.
Run: https://github.com/github/gh-aw/actions/runs/43219905085

📊 Executive Summary

• Total Secret References (secrets.*): 17,723
• GitHub Token References (github.token): 3,996
• Unique Secret Types: 46
• Job-Level Usage (YAML-parsed): 0 jobs with secrets in jobs.*.env
• Step-Level Usage (YAML-parsed): 7,611 step env/with blocks

Note: the grep heuristic in the workflow reported 9,348 step-level matches, which over-counts. The YAML-parsed figure is used here.

🛡️ Security Posture

✅ Redaction System: 365/365 workflows have redaction steps
✅ Token Cascades: 1,570 instances of fallback chains
✅ Permission Blocks: 365 explicit permission definitions

Compile-time checks (go test ./pkg/workflow/):

• ✅ TestCompiledLockFiles_NoGitHubEventExpressionsInRunScripts: no direct github.event interpolation in run: scripts
• ✅ TestCompiledLockFiles_NoSecretsInOutputs: no secrets in job outputs

🎯 Key Findings

1. Token usage is concentrated: GITHUB_TOKEN (6,769), GH_AW_GITHUB_TOKEN (6,216), and GH_AW_GITHUB_MCP_SERVER_TOKEN (2,621) account for most token references.
2. Observability secrets are widely used: GH_AW_OTEL_SENTRY_AUTHORIZATION (1,211), GH_AW_OTEL_SENTRY_ENDPOINT (965), GH_AW_OTEL_GRAFANA_AUTHORIZATION (961).
3. Model provider keys: OPENAI_API_KEY (185), CODEX_API_KEY (184), ANTHROPIC_API_KEY (173).
4. Scope: no job-level secret exposure was detected in jobs.*.env. All secret references are step-scoped.
5. Trend: this is the first run. No baseline existed in cache memory, so no trend comparison was possible. The baseline has been saved for the next run.

💡 Recommendations

1. Re-run on a full-history checkout pinned to 2026-11-08 so the snapshot matches the report date.
2. Consolidate overlapping token variables (GITHUB_TOKEN, GH_AW_GITHUB_TOKEN, GH_AW_GITHUB_MCP_SERVER_TOKEN) to reduce the 1,570 fallback chains.
3. Replace the grep heuristics in Step 4 of the analysis with YAML parsing. The current heuristic undercounts job-level and overcounts step-level usage.

🔑 Top 10 Secrets by Usage

Rank	Secret Name	Occurrences	Type
1	GITHUB_TOKEN	6,769	GitHub Token
2	GH_AW_GITHUB_TOKEN	6,216	GitHub Token
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	2,621	GitHub Token
4	GH_AW_OTEL_SENTRY_AUTHORIZATION	1,211	Observability
5	GH_AW_OTEL_SENTRY_ENDPOINT	965	Observability
6	GH_AW_OTEL_GRAFANA_AUTHORIZATION	961	Observability
7	COPILOT_GITHUB_TOKEN	744	GitHub Token
8	GH_AW_OTEL_GRAFANA_ENDPOINT	715	Observability
9	GH_AW_DEFAULT_OTLP_HEADERS	406	Observability
10	GH_AW_DEFAULT_OTLP_ENDPOINT	406	Observability

📈 Trends

• First run: no historical baseline available.
• Baseline saved to cache memory for comparison on the next run.

📖 Reference Documentation

• Redaction System: actions/setup/js/redact_secrets.cjs

---

Generated: 2026-11-12T12:43Z
Dedup key: daily-report:daily-secrets-analysis:2026-11-08
Workflow: .github/workflows/daily-secrets-analysis.md

Generated by 🔒 Daily Secrets Analysis Agent · copilot · routed: haiku55 xhigh · ~2 AIC · ⌖ ~2 AIC · ⊞ 8.1K · ◷
Claim finished

• expires on Nov 15, 2026, 4:51 AM UTC-08:00