[lockfile-stats] Lockfile Statistics Audit — 2026-10-13

[github-actions[bot]]

Analyzed 341 compiled .github/workflows/*.lock.yml files (0 skipped, 0 parse errors). Methodology: single-script compact JSON analysis (cached analyzer, lockfile_stats_v4.py).

Executive summary

Metric	Value
Lockfiles	341
Total size	55,183,653 bytes (~52.6 MB)
Avg / min / max size	161,829 / 90,592 / 290,779 bytes
Total jobs / max per file	2,422 / 23
Total steps / max per file	49,435 / 326
Script steps / max per file	21,814 / 97

File size distribution

• Avg size is stable (~161.8 KB), consistent with prior runs — new workflows are following existing size patterns, not outliers.
• Largest and smallest files are within ~3.2x of each other (290,779 vs 90,592 bytes), suggesting no extreme structural outliers.

Trigger analysis

Trigger	Count
workflow_dispatch	332 (97%)
schedule	248 (73%)
pull_request	46
workflow_call	5
issues	5
issue_comment	3
push	2
discussion / discussion_comment / pull_request_review_comment / deployment_status / workflow_run	1 each

Top trigger combinations: schedule+workflow_dispatch (212, 62%), workflow_dispatch only (71, 21%), pull_request+schedule+workflow_dispatch (32, 9%).

Schedule cron frequencies are heavily clustered: 0 0 */2 * * (every 2 days at midnight) is used by 57 workflows (17% of all lockfiles) — by far the dominant cadence. All other crons appear ≤3 times each.

Safe outputs analysis

Core safe-output tools (missing_data, missing_tool, noop, report_incomplete, create_report_incomplete_issue) each appear in 334 workflows — effectively universal. Among domain-specific outputs: create_issue (180, 53%), create_discussion (92, 27%), add_comment (74, 22%), create_pull_request (65, 19%).

Discussion category detection (self-check passed: create_discussion_workflows=93 > 0, discussion_category_detected=92 > 0, gap 1.1% < 10% threshold):

Category	Count
audits	79
announcements	5
artifacts	2
dev	2
research	2
general	1
daily-news	1

1 workflow (pr-sous-chef.lock.yml) has an unresolved category — same gap as prior runs, likely a create_discussion config with no GH_AW_SAFE_OUTPUTS_CONFIG match (also accounts for the sole safe_outputs_config_missing=1). No fallback regex parses were needed elsewhere (discussion_category_fallback_parsed=0).

Structural characteristics

• Jobs: 2,422 total, up to 23 in a single workflow.
• Steps: 49,435 total, up to 326 in a single workflow.
• Script (run) steps: 21,814 total, up to 97 in a single workflow.

Permission patterns (agent job)

Derived from jobs.agent.permissions / union across jobs — never from the always-empty top-level permissions: {}. permissions_unknown = 0 (fully resolved for all 341 lockfiles).

Scope	Read	Write
contents	341	0
issues	261	0
pull-requests	255	0
actions	140	0
discussions	53	0
security-events	14	0
copilot-requests	0	165
id-token	0	2

Union-of-jobs write grants: issues (339/341, 99%), contents (228), copilot-requests (165), pull-requests (150), discussions (96), checks (14). 339 of 341 workflows (99%) grant at least one write scope somewhere in their job graph, even though the primary agent job is predominantly read-only — consistent with the safe-outputs pattern (agent proposes, a separate job applies writes).

Engine distribution

(from gh-aw-metadata agent_id; engine_unknown = 0, fully resolved)

Engine	Count	Share
copilot	140	41%
codex	76	22%
claude	62	18%
pi	37	11%
aider	4
goose	4
agy	3
opencode	3
crush, cursor, deepseek-harness, gemini, kiro, pydantic-ai	2 each

Tool & MCP patterns

MCP server	Workflows
safeoutputs	318 (93%)
github	193 (57%)
work-queue	33
agenticworkflows	27
mcpscripts	26
serena	17

mcp_fallback_count = 7 (legacy lockfiles without a gh-aw-manifest, scraped via # - mcp__... comments).

Interesting findings

1. One cron dominates: 0 0 */2 * * is used by 57 workflows (17%) — far more than any other schedule, suggesting a common copy-paste default rather than workload-tuned cadences.
2. copilot-requests is write-only: granted in 165 workflows but never read, roughly matching (but exceeding) the 140 workflows using the copilot engine — other engines may also invoke Copilot APIs for secondary tasks.
3. Agent jobs are read-dominant, but the workflow as a whole nearly always writes: 341/341 agent jobs read contents, none write it directly, yet 339/341 workflows (99%) grant a write scope somewhere in the job graph — the safe-outputs apply-job pattern is now nearly universal.
4. Discussion category gap is stable, not new: the same single workflow (pr-sous-chef.lock.yml) has lacked a resolvable category across at least the last several runs — worth a one-time fix rather than a recurring investigation.
5. Engine long tail: beyond the top 4 engines (copilot/codex/claude/pi, 92% of workflows combined), 10 other engines each power ≤4 workflows — a wide but shallow experimentation surface.

Historical trends (vs. 2026-10-11)

Metric	2026-10-11	2026-10-13	Δ
Lockfiles	337	341	+4
Total bytes	54,556,783	55,183,653	+626,870 (+1.1%)
workflow_dispatch	328	332	+4
schedule	244	248	+4
create_issue	176	180	+4
create_discussion	92	92	0
Total jobs	2,398	2,422	+24
Total steps	48,604	49,435	+831
Script steps	21,598	21,814	+216
copilot engine	138	140	+2
claude engine	61	62	+1
pi engine	36	37	+1
safeoutputs MCP	313	318	+5
github MCP	188	193	+5
cron 0 0 */2 * *	53	57	+4

The +4 new lockfiles since 2026-10-11 all appear to follow the same template: schedule+workflow_dispatch trigger, create_issue safe output, contents:read + copilot-requests:write permissions, and the 0 0 */2 * * cron — consistent with 4 new copilot-engine workflows added via a shared scaffold.

Recommendations

• Resolve the long-standing unresolved discussion category on pr-sous-chef.lock.yml so the detection gap closes to 0.
• Consider diversifying the 0 0 */2 * * cron cluster (57 workflows) if these jobs don't actually need identical timing — collisions could cause runner contention.
• Audit whether all 165 copilot-requests: write grants are necessary, given only 140 workflows declare the copilot engine.

Methodology note: single-script compact JSON analysis.

Generated by 📊 Lockfile Statistics Analysis Agent · claude · agent · 68.1 AIC · ⊞ 6.5K · ◷

• expires on Oct 14, 2026, 12:30 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Lockfile Statistics Analysis Agent.

A newer discussion is available at Discussion #68822.