[lockfile-stats] Lockfile Statistics Audit — 2026-06-07

[github-actions[bot]]

Executive Summary

Snapshot of 245 compiled workflow lockfiles (.github/workflows/*.lock.yml) on 2026-06-07. 0 files were malformed/skipped.

Metric	Value	Δ vs 2026-06-06
Lockfiles	245	+3
Total size	25.78 MiB (27,036,815 B)	+1.16 MiB (+4.7%)
Average size	110,354 B	+3,662 (+3.4%)
Median size	109,841 B	+3,777
Min / Max	72,248 B / 170,571 B	+3,587 / +3,732
Total jobs	1,965	+24
Total steps	26,715	+802
Total inline scripts	12,696	+388

Compiled lockfiles continue a steady upward drift in size — the generator footprint per workflow grew ~3.4% in a single day, with the file-size distribution shifting markedly toward the larger bucket (see below).

File Size Distribution

Bucket	Count	Δ
50–100 KB	37	−28
100–250 KB	208	+31

A pronounced one-day migration from the 50–100 KB band into the 100–250 KB band (+31 / −28) indicates a broad-based recompilation that added boilerplate to nearly every mid-sized workflow rather than a few outliers growing.

Largest & smallest lockfiles

Largest

File	Bytes
smoke-copilot-aoai-apikey.lock.yml	170,571
smoke-copilot.lock.yml	169,828
smoke-claude.lock.yml	165,895
smoke-copilot-arm.lock.yml	158,194
smoke-codex.lock.yml	144,902
mcp-inspector.lock.yml	141,586
issue-monster.lock.yml	139,700
deep-report.lock.yml	138,927
cloclo.lock.yml	136,645
daily-news.lock.yml	134,479

Smallest

File	Bytes
test-workflow.lock.yml	72,248
codex-github-remote-mcp-test.lock.yml	72,895
example-permissions-warning.lock.yml	72,902
firewall.lock.yml	74,152
ace-editor.lock.yml	81,649

The smoke-* family (engine smoke tests) dominates the top of the size table across all engines.

Trigger Analysis

Trigger	Workflows	Δ
workflow_dispatch	237	+3
schedule	166	+3
pull_request	33	0
issues	4	0
issue_comment	2	0
push	2	0
workflow_run / discussion / discussion_comment / pull_request_review_comment	1 each	0

workflow_dispatch is near-universal (237/245 ≈ 97%) — manual triggerability is effectively a project convention. Scheduled automation covers 166 workflows (68%).

Top trigger combinations

Combination	Count
schedule + workflow_dispatch	162
workflow_dispatch (only)	45
pull_request + workflow_dispatch	26
pull_request (only)	3
pull_request + push + schedule + workflow_dispatch	1
discussion + discussion_comment + issue_comment + issues + pull_request + pull_request_review_comment	1

The single 6-event workflow is an unusually broad listener (likely an all-events moderator/triage agent).

Schedule cron frequencies

29 distinct cron expressions are in use. Most fire once daily; a handful are weekday-only (* * 1-5), weekly (* * 0 / * * 1 / * * 3), every-6-hour (*/6), every-4-hour (*/4), hourly (23 * * * *), or every-7-day (0 0 */7 * *). The crons are well-jittered across the minute field — no :00 pile-ups — which is good scheduling hygiene for an API-bound fleet.

Safe Outputs Analysis

⚠️ Parser limitation (v1 analyzer): the cached lockfile_stats_v1.py schema did not extract safe_output_types, discussion_categories, or structured permissions from the compiled lockfiles (these came back empty for all 245 files in both today's and the prior run). These sections are therefore not reported with confidence this cycle. This is a known schema gap, not a sign that workflows lack safe-outputs — they are emitted differently in the compiled YAML than the v1 regexes anticipated. Recommend bumping to lockfile_stats_v2.py to capture them (see Recommendations).

Structural Characteristics

Metric	Min	Avg	Max	Max workflow
Jobs / workflow	5	8.02	12	firewall-escape.lock.yml
Steps / workflow	71	109.04	148	smoke-copilot.lock.yml

Average steps per workflow rose 107.08 → 109.04 day-over-day, and the busiest workflow grew 146 → 148 steps — consistent with the size-bucket migration above. With 245 workflows averaging ~109 steps each, the fleet compiles to ~26.7k generated steps total.

Permission Patterns

⚠️ The v1 analyzer recorded top-level permissions as an empty object ({}) for all 245 lockfiles and captured no read/write scope distribution. As with safe outputs, this is a v1 schema gap rather than a finding about the workflows themselves. Deferred to v2.

Tool & MCP Patterns

Engine distribution (by occurrence in compiled output):

Engine	Count	Δ
copilot	162	+3
claude	64	0
codex	14	0
antigravity / crush / gemini / opencode / pi	1 each	0

Copilot is the dominant engine and absorbed all 3 new workflows today; Claude holds steady at 64.

MCP server usage (occurrence-weighted, not per-workflow):

Server	Occurrences
github	6,656
playwright	168
sentry	96
ruflo	16
grafana	14
arxiv	6
deepwiki	6

Note: these are raw mcp__server__tool occurrence counts across all lockfiles (allow-lists inflate github heavily), not counts of workflows using each server. The github read-tool surface (get_commit, issue_read, list_commits, ...) appears in ~128 lockfiles each, reflecting the standard read-only github toolset bundled into roughly half the fleet.

Timeout distribution

timeout-minutes bucket	Count	Δ
≤5	16	+2
6–15	364	+3
16–30	326	+4
31–60	32	0
>60	3	0

Most timeouts cluster in 6–30 min. Only 3 step/job timeouts exceed 60 min — a tight, sensible ceiling for an agentic fleet.

Interesting Findings

1. Uniform daily growth, not outlier growth. Min, median, max, and average sizes all rose ~3.4–5%, and 31 files crossed the 100 KB line in one day — the recompilation added boilerplate fleet-wide, not to a few workflows.
2. workflow_dispatch is a de-facto standard (97% of workflows). Only 8 workflows omit manual triggering.
3. Copilot captured 100% of new workflows. All 3 net-new lockfiles use the copilot engine; the engine mix is tilting further toward copilot (now 162 vs claude 64).
4. One 6-event super-listener subscribes to discussion, discussion_comment, issue_comment, issues, pull_request, and pull_request_review_comment simultaneously — an outlier worth reviewing for trigger scope.
5. Excellent cron jitter. 29 distinct schedules spread across non-round minute marks — no thundering-herd :00 scheduling against the API.

Historical Trends

Comparison vs the immediately prior summary (2026-06-06). An 18-day history (2026-05-20 → 2026-06-07) is cached; the fleet has grown from 242 → 245 workflows this cycle with steady per-file size inflation. Today's notable signal is the bucket migration: +31 workflows into 100–250 KB, the largest single-day band shift in the recent window.

Recommendations

1. Bump the analyzer to lockfile_stats_v2.py to fix the three v1 schema gaps: safe_output_types, discussion_categories, and structured permissions (read/write scope) extraction. These are currently blind spots.
2. Investigate the fleet-wide +3.4% size growth. A uniform increase usually means a generator/template change added boilerplate to every compiled lockfile — worth confirming it is intentional, since at 245 files it compounds (+1.16 MiB/day of repo churn).
3. Report per-workflow MCP server adoption (workflows-using-X) alongside raw occurrence counts so the github inflation does not mask real server diversity.
4. Review the 6-event super-listener for least-privilege trigger scope.

Methodology

Single-script compact JSON analysis: one cached Python analyzer (lockfile_stats_v1.py) parsed all 245 lockfiles in one pass, emitting a 4.8 KB compact JSON summary; all insights above were derived from that summary plus the cached prior-day summary. No lockfiles were opened individually for analysis. 0 malformed files skipped.

References: §27104130693

Generated by 📊 Lockfile Statistics Analysis Agent · 79.5 AIC · ⌖ 12.4 AIC · ⊞ 5.4K · ◷

• expires on Jun 8, 2026, 12:43 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Lockfile Statistics Analysis Agent.

A newer discussion is available at Discussion #37938.