[daily secrets] 🔐 Daily Secrets Analysis Report – 2026-06-25

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-06-25
Workflow Files Analyzed: 251
Run: §28191350999

---

📊 Executive Summary

Metric	Value
Total secrets.* references	7,380
github.token references	1,522
Total token/secret references	8,902
Unique secret names	38
Workflows analyzed	251 / 251

Distribution by category:

• 🔑 GitHub auth tokens: 5,745 refs (64.5%)
• 📡 Observability secrets: 987 refs (11.0%)
• 🤖 AI/LLM API keys: 384 refs (4.3%)
• 🔧 Other secrets: ~270 refs (~3.0%)

---

🛡️ Security Posture: ✅ EXCELLENT

Control	Coverage	Status
Secret redaction steps	251 / 251 workflows	✅ Full
Explicit permissions: blocks	251 / 251 workflows	✅ Full
3-tier token cascade	251 / 251 workflows	✅ Full
Secrets in job outputs	0 / 251 workflows	✅ None
Unsandboxed github.event.*	0 occurrences	✅ Safe

All github.event.* expressions are properly sandboxed into environment variables (the GH_AW_EXPR_* pattern), preventing template injection. Embedded Handlebars-style conditionals in prompt text use safe sentinel substitution (__GH_AW_EXPR_*__), not live expression evaluation.

---

🎯 Key Findings

1. Uniform security baseline across all 251 workflows — Every compiled workflow applies the same hardened pattern: explicit least-privilege permissions, redaction middleware, and token cascade. This reflects the compiler enforcing policy rather than individual workflow authors.

2. GitHub auth dominates (64.5% of refs) — The 3-tier token cascade (secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN) is applied in every workflow, generating ~9 references per workflow just for auth. This is expected and intentional.

3. Dual Datadog integration paths detected — mcp-inspector.lock.yml and smoke-otel-backends.lock.yml use native Datadog SDK secrets (DD_API_KEY, DD_APPLICATION_KEY, DD_SITE) alongside the standard GH_AW_OTEL_DATADOG_* OTEL bridge used by the broader fleet. This is a minor consistency anomaly worth tracking.

4. CONTEXT7_API_KEY is a third-party service key — Used only in mcp-inspector.lock.yml. The grep pattern secrets\.[A-Z_]* extracts this as CONTEXT (stops at 7). The full name is CONTEXT7_API_KEY, representing an external API integration specific to that workflow.

5. Observability coverage is broad — Sentry and Grafana OTEL secrets appear across ~232+ workflow invocations each, indicating near-universal observability instrumentation.

---

💡 Recommendations

1. Consolidate Datadog integration — Decide between native DD SDK (DD_*) and the OTEL bridge (GH_AW_OTEL_DATADOG_*). Having both paths in the fleet increases the secret surface. If migrating to OTEL, retire the DD_* secrets from the 2 outlier workflows.

2. Review CONTEXT7_API_KEY scoping — Single-workflow secrets are acceptable, but ensure mcp-inspector has appropriate permissions scoping and the secret is rotated on the same schedule as other API keys.

3. Monitor AI/LLM key sprawl — Currently 38% of workflows (76/251) use at least one AI/LLM key, with multiple provider keys (ANTHROPIC_API_KEY, OPENAI_API_KEY, CODEX_API_KEY, GEMINI_API_KEY, FOUNDRY_API_KEY, OPENROUTER_API_KEY) active. As the workflow fleet grows, periodically audit for unused AI provider keys.

---

🔑 Top 10 Secrets by Reference Count

Rank	Secret Name	References	Category
1	secrets.GITHUB_TOKEN	4,132	GitHub Auth
2	secrets.GH_AW_GITHUB_TOKEN	3,242	GitHub Auth
3	github.token	1,522	GitHub Auth
4	secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN	1,370	GitHub Auth
5	secrets.GH_AW_OTEL_SENTRY_AUTHORIZATION	696	Observability
6	secrets.GH_AW_OTEL_SENTRY_ENDPOINT	465	Observability
7	secrets.GH_AW_OTEL_GRAFANA_AUTHORIZATION	463	Observability
8	secrets.COPILOT_GITHUB_TOKEN	444	GitHub Auth
9	secrets.GH_AW_OTEL_GRAFANA_ENDPOINT	232	Observability
10	secrets.ANTHROPIC_API_KEY	229	AI/LLM

🤖 AI/LLM Provider Coverage

Secret	References	Workflows Using It
ANTHROPIC_API_KEY	229	~59
OPENAI_API_KEY	87	~30
CODEX_API_KEY	86	~29
TAVILY_API_KEY	12	~4
SENTRY_OPENAI_API_KEY	10	~3
GEMINI_API_KEY	5	~2
FOUNDRY_API_KEY	2	~1
BRAVE_API_KEY	4	~1
ANTIGRAVITY_API_KEY	4	~1
OPENROUTER_API_KEY	1	~1

Anthropic dominates at 229 references across 59 workflows.

🔗 Token Cascade Architecture

All 251 workflows implement the 3-tier token cascade pattern for MCP server auth:

secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN
  || secrets.GH_AW_GITHUB_TOKEN
  || secrets.GITHUB_TOKEN

This provides graceful fallback across token types, ensuring workflows can operate with any combination of available secrets. The pattern is compiler-enforced.

📖 Reference Documentation

• Secrets specification: scratchpad/secrets-yml.md
• Redaction system: actions/setup/js/redact_secrets.cjs
• Token cascade spec: See GH_AW_GITHUB_MCP_SERVER_TOKEN usage in any .lock.yml

---

Generated: 2026-06-25T18:24:57Z
Workflow Run: §28191350999

Generated by 🔒 Daily Secrets Analysis Agent · 41.2 AIC · ⌖ 13.2 AIC · ⊞ 6.2K · ◷

• expires on Jun 28, 2026, 10:30 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Daily Secrets Analysis Agent.

A newer discussion is available at Discussion #41775.