[daily secrets] 🔐 Secrets Analysis Report — 2026-07-12

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-07-12
Workflow Files Analyzed: 256
Run: §29202875795

📊 Executive Summary

Metric	Value
Total secrets.* references	8,377
github.token references	1,567
Unique secret types	40
Workflows with redaction	256 / 256 (100%)
Token cascade patterns	922
Permission blocks	256 / 256 (100%)

🛡️ Security Posture

✅ Redaction System: All 256 workflows include redact_secrets steps
✅ Token Cascades: 922 fallback chain instances (GH_AW_GITHUB_MCP_SERVER_TOKEN || GH_AW_GITHUB_TOKEN || GITHUB_TOKEN)
✅ Permission Blocks: All 256 workflows define explicit permissions:
✅ Secrets in Outputs: No direct secret values exposed in job outputs

🎯 Key Findings

1. 100% Redaction Coverage: Every compiled workflow includes the redact_secrets.cjs step — a strong baseline posture.
2. Token Cascade Adoption: 922 instances of the 3-tier fallback chain ensure minimal-privilege token selection is consistently applied.
3. High GITHUB_TOKEN Concentration: secrets.GITHUB_TOKEN (4,238 refs) and secrets.GH_AW_GITHUB_TOKEN (3,618 refs) together account for ~93% of all secret references, which is expected for a GitHub Actions automation platform.
4. AI Provider Keys Present: ANTHROPIC_API_KEY (242 refs), OPENAI_API_KEY (81 refs), CODEX_API_KEY (80 refs), and GEMINI_API_KEY (5 refs) are present — these are high-value secrets warranting key rotation policy review.
5. Observability Secrets: Sentry, Grafana, and Datadog credentials appear across many workflows; ensure these are scoped to write-only or minimal permissions.

💡 Recommendations

1. AI Provider Key Rotation: Establish a quarterly rotation policy for ANTHROPIC_API_KEY, OPENAI_API_KEY, CODEX_API_KEY given their high usage and sensitivity.
2. Observability Credential Scoping: Audit GH_AW_OTEL_SENTRY_*, GH_AW_OTEL_GRAFANA_*, and DD_* credentials to confirm they use minimal-scope API tokens.
3. Third-Party API Keys: Review single-use keys (SLACK_BOT_TOKEN, OPENROUTER_API_KEY, NOTION_API_TOKEN) to confirm they are still needed and not dormant.
4. Azure Credentials: AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, AZURE_TENANT_ID appear in only 2 workflows — verify they are correctly scoped to those workflows only.

🔑 Top 15 Secrets by Usage

Rank	Secret Name	Occurrences	Category
1	GITHUB_TOKEN	4,238	GitHub Token
2	GH_AW_GITHUB_TOKEN	3,618	GitHub Token (PAT)
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	1,690	GitHub Token (MCP)
4	COPILOT_GITHUB_TOKEN	701	GitHub Token (Copilot)
5	GH_AW_OTEL_SENTRY_AUTHORIZATION	699	Observability
6	GH_AW_OTEL_SENTRY_ENDPOINT	467	Observability
7	GH_AW_OTEL_GRAFANA_AUTHORIZATION	465	Observability
8	ANTHROPIC_API_KEY	242	AI Provider
9	GH_AW_OTEL_GRAFANA_ENDPOINT	233	Observability
10	OPENAI_API_KEY	81	AI Provider
11	CODEX_API_KEY	80	AI Provider
12	GH_AW_CI_TRIGGER_TOKEN	60	CI/CD
13	GH_AW_SIDE_REPO_PAT	24	GitHub Token (PAT)
14	GH_AW_AGENT_TOKEN	15	Agent Token
15	TAVILY_API_KEY	12	Search API

📋 All 40 Unique Secrets by Category

GitHub Tokens (6)
GITHUB_TOKEN, GH_AW_GITHUB_TOKEN, GH_AW_GITHUB_MCP_SERVER_TOKEN, COPILOT_GITHUB_TOKEN, GH_AW_PROJECT_GITHUB_TOKEN, GH_AW_SIDE_REPO_PAT

Observability (10)
GH_AW_OTEL_SENTRY_AUTHORIZATION, GH_AW_OTEL_SENTRY_ENDPOINT, GH_AW_OTEL_GRAFANA_AUTHORIZATION, GH_AW_OTEL_GRAFANA_ENDPOINT, GH_AW_OTEL_DATADOG_API_KEY, GH_AW_OTEL_DATADOG_ENDPOINT, DD_API_KEY, DD_APPLICATION_KEY, DD_APP_KEY, DD_SITE

AI Providers (7)
ANTHROPIC_API_KEY, OPENAI_API_KEY, CODEX_API_KEY, GEMINI_API_KEY, OPENROUTER_API_KEY, SENTRY_OPENAI_API_KEY, FOUNDRY_API_KEY

CI/CD & Automation (4)
GH_AW_CI_TRIGGER_TOKEN, GH_AW_AGENT_TOKEN, AWI_MAINTENANCE_TOKEN, CONTEXT

Third-Party Services (8)
TAVILY_API_KEY, BRAVE_API_KEY, SLACK_BOT_TOKEN, NOTION_API_TOKEN, SENTRY_ACCESS_TOKEN, GRAFANA_SERVICE_ACCOUNT_TOKEN, GRAFANA_URL, ANTIGRAVITY_API_KEY

Cloud/Infrastructure (5)
AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, AZURE_TENANT_ID, FOUNDRY_OPENAI_ENDPOINT, CODEX_API_KEY

📖 Reference Documentation

• Specification: scratchpad/secrets-yml.md
• Redaction System: actions/setup/js/redact_secrets.cjs
• Token cascade pattern: secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN

---

Generated: 2026-07-12T17:56 UTC
Workflow Run: §29202875795

Generated by 🔒 Daily Secrets Analysis Agent · 23.1 AIC · ⌖ 9.44 AIC · ⊞ 6.2K · ◷

• expires on Jul 15, 2026, 10:00 AM UTC-08:00