[daily secrets] Daily Secrets Analysis — 2026-04-16

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-04-16
Workflow Files Analyzed: 192
Run: §24537045533

---

📊 Executive Summary

Metric	Value
secrets.* References	4,285
github.token References	777
Unique Secret Types	29
Workflows with Redaction	192 / 192 (100%)
Workflows with Permissions	192 / 192 (100%)
Token Cascade Fallbacks	723 instances
External API Key Workflows	71
Secrets Exposed in Outputs	0 ✅

---

🛡️ Security Posture

✅ Redaction System: All 192 workflows include redact_secrets steps
✅ Permission Blocks: All 192 workflows declare explicit permissions:
✅ Token Cascades: 723 instances of safe fallback chains (GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN)
✅ No Secrets in Outputs: Zero secret values exposed via job output bindings
✅ Event Interpolation: All github.event.* references are used safely (IDs into env vars and if: conditions — not free-form text expansion)

---

🎯 Key Findings

1. GitHub Token Dominates — The top 3 secrets (GITHUB_TOKEN, GH_AW_GITHUB_TOKEN, GH_AW_GITHUB_MCP_SERVER_TOKEN) account for 6,080 of the 4,285+ references (>47%), consistent with the multi-tier token cascade architecture.

2. External AI Provider Keys — 71 workflows reference at least one external API key (Anthropic, OpenAI, Codex, Gemini, etc.), reflecting the multi-engine design of gh-aw. Each of these flows through a per-workflow env: block within agent job steps.

3. Observability Secrets — GH_AW_OTEL_ENDPOINT (159 refs) and GH_AW_OTEL_HEADERS (53 refs) indicate consistent OpenTelemetry instrumentation across most workflow compilations.

4. Low-Use Secrets — Several secrets appear very rarely (1–4 references): SLACK_BOT_TOKEN, GH_AW_PLUGINS_TOKEN, CONTEXT, and the Azure/Sentry/Datadog clusters. These are likely workflow-specific integrations.

---

💡 Recommendations

1. Audit low-use secrets — Secrets appearing only 1–4 times (e.g., SLACK_BOT_TOKEN, GH_AW_PLUGINS_TOKEN, CONTEXT) should be reviewed to confirm they are actively used and not orphaned references.

2. Azure credential rotation — The Azure service principal secrets (AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, AZURE_TENANT_ID) appear in only 2 workflows. Ensure rotation policies are in place for these high-privilege credentials.

3. Sentry key consolidation — Three separate Sentry secrets (SENTRY_ACCESS_TOKEN, SENTRY_API_KEY, SENTRY_OPENAI_API_KEY) each appear exactly twice. Consider whether these could be unified into a single secret.

---

🔑 Top 10 Secrets by Usage

Rank	Secret Name	Occurrences	Category
1	GITHUB_TOKEN	2,443	GitHub Auth
2	GH_AW_GITHUB_TOKEN	2,358	GitHub Auth (PAT)
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	1,079	MCP Server Auth
4	COPILOT_GITHUB_TOKEN	302	Copilot Engine
5	ANTHROPIC_API_KEY	216	AI Provider
6	GH_AW_OTEL_ENDPOINT	159	Observability
7	OPENAI_API_KEY	60	AI Provider
8	CODEX_API_KEY	60	AI Provider
9	GH_AW_OTEL_HEADERS	53	Observability
10	GH_AW_CI_TRIGGER_TOKEN	45	CI Automation

Note: Token counts reflect expressions compiled into 192 workflow YAML files; each workflow typically references the cascade chain multiple times across jobs and steps.

📋 All 29 Unique Secrets

Secret Name	Occurrences	Category
GITHUB_TOKEN	2,443	GitHub Auth
GH_AW_GITHUB_TOKEN	2,358	GitHub Auth (PAT)
GH_AW_GITHUB_MCP_SERVER_TOKEN	1,079	MCP Server Auth
COPILOT_GITHUB_TOKEN	302	Copilot Engine
ANTHROPIC_API_KEY	216	AI Provider
GH_AW_OTEL_ENDPOINT	159	Observability
OPENAI_API_KEY	60	AI Provider
CODEX_API_KEY	60	AI Provider
GH_AW_OTEL_HEADERS	53	Observability
GH_AW_CI_TRIGGER_TOKEN	45	CI Automation
GH_AW_SIDE_REPO_PAT	19	GitHub Auth (PAT)
GH_AW_AGENT_TOKEN	15	Agent Auth
TAVILY_API_KEY	13	Search API
GH_AW_PROJECT_GITHUB_TOKEN	7	GitHub Auth (PAT)
NOTION_API_TOKEN	6	Integration
GEMINI_API_KEY	4	AI Provider
BRAVE_API_KEY	4	Search API
DD_SITE	3	Datadog
DD_APPLICATION_KEY	3	Datadog
DD_API_KEY	3	Datadog
SENTRY_OPENAI_API_KEY	2	Error Tracking
SENTRY_API_KEY	2	Error Tracking
SENTRY_ACCESS_TOKEN	2	Error Tracking
CONTEXT	2	Misc
AZURE_TENANT_ID	2	Azure Auth
AZURE_CLIENT_SECRET	2	Azure Auth
AZURE_CLIENT_ID	2	Azure Auth
SLACK_BOT_TOKEN	1	Notification
GH_AW_PLUGINS_TOKEN	1	Plugin Auth

📖 Reference Documentation

For detailed information about secret usage patterns, see:

• Specification: scratchpad/secrets-yml.md
• Redaction System: actions/setup/js/redact_secrets.cjs

---

Generated: 2026-04-16T22:23:07Z
Workflow Run: §24537045533

Generated by Daily Secrets Analysis Agent · ● 378.9K · ◷

• expires on Apr 19, 2026, 10:26 PM UTC

[github-actions[bot]]

This discussion has been marked as outdated by Daily Secrets Analysis Agent.

A newer discussion is available at Discussion #26950.