[lockfile-stats] Lockfile Statistics Analysis — 2026-06-18

[github-actions[bot]]

Aggregate analysis of all compiled .github/workflows/*.lock.yml agentic workflow lockfiles.

Executive summary

Metric	Value
Lockfiles analyzed	250 (0 skipped)
Total size	28.1 MB (29,465,289 bytes)
Avg / median size	115.1 KB / 114.5 KB
Min / max size	76.2 KB / 173.5 KB
Total jobs / steps / scripts	2,008 / 28,264 / 12,527
Engines in use	8 distinct

File size distribution

Bucket	Count
50–100 KB	12
100–250 KB	238

Lockfiles are large and tightly clustered (avg 115 KB, median 114.5 KB), reflecting the substantial boilerplate the compiler emits per workflow.

Largest & smallest lockfiles

Largest: smoke-copilot-aoai-entra (173.5 KB), smoke-copilot-aoai-apikey (173.1 KB), smoke-copilot (172.4 KB), smoke-claude (170.6 KB), smoke-copilot-arm (160.8 KB)

Smallest: test-workflow (76.2 KB), example-permissions-warning (76.9 KB), firewall (78.1 KB), codex-github-remote-mcp-test (78.1 KB), ace-editor (85.2 KB)

Trigger analysis

Trigger	Workflows
workflow_dispatch	242
schedule	167
pull_request	33
issues	4
issue_comment	2
push	2
workflow_run / discussion / discussion_comment / pull_request_review_comment	1 each

Top combinations: schedule+workflow_dispatch (163), workflow_dispatch only (49), pull_request+workflow_dispatch (26). Nearly all workflows (242/250) expose manual dispatch, and scheduled automation dominates (167 cron-driven).

Safe outputs analysis

Safe-output type and discussion-category markers were not extractable from the v1 schema's compiled lockfiles (the structured config is encoded in a form the current parser does not surface). Reported counts are empty for this run; this is a known analyzer limitation rather than an absence of safe outputs. (Flagged for a schema bump — see Recommendations.)

Structural characteristics

Metric	Min	Avg	Max
Jobs / workflow	5	8.03	12 (firewall-escape)
Steps / workflow	76	113.1	152 (smoke-copilot)

Total scripts embedded across all lockfiles: 12,527.

Permission patterns

All 250 lockfiles report an empty ({}) top-level permissions kind in the compiled output; granular read/write per-scope grants were not captured by the v1 parser. Treat as not-yet-instrumented.

Tool & MCP patterns

MCP server	References
github	6,656
playwright	168
sentry	96
grafana	28
ruflo	16
arxiv / deepwiki	6 each

GitHub MCP overwhelmingly dominates tool usage; get_*/list_* read tools each appear ~128 times, consistent with the read-only GitHub MCP surface being injected uniformly across most workflows.

Engine distribution: copilot 167, claude 64, codex 14, then antigravity / crush / gemini / opencode / pi (1 each).

Timeout distribution: 16–30 min 335, 31–60 min 283, 6–15 min 122, ≤5 min 16, >60 min 3.

Interesting findings

1. Manual dispatch is near-universal — 242/250 (96.8%) workflows expose workflow_dispatch, and 163 pair it with a schedule (the canonical "cron + manual override" pattern).
2. Copilot is the default engine — 167/250 (66.8%) use the copilot engine; claude (64) is second. Six niche engines have a single workflow each.
3. GitHub MCP saturation — 6,656 github MCP references vs. 314 for all other servers combined; ~20× more than the next-largest surface.
4. Size floor is high — even the smallest lockfile is 76 KB; compiled boilerplate sets a steep fixed cost per workflow.
5. Cron spread avoids collisions — scheduled crons use scattered minute/hour offsets (e.g. 49 14 * * 1-5, 27 */6 * * *) rather than clustering on :00, distributing fleet load.

Historical trends (vs 2026-06-17)

Metric	06-17	06-18	Δ
Lockfiles	250	250	0
Total bytes	29,821,184	29,465,289	−355,895
Avg size	119,284	117,861	−1,423
Total steps	28,374	28,264	−110
Total scripts	12,525	12,527	+2
Jobs total	2,008	2,008	0

Engine, trigger, and MCP-server distributions are unchanged day-over-day. The modest size/step reduction (−356 KB, −110 steps) with stable workflow count indicates a small compiler/template trim rather than workflow churn.

Recommendations

1. Bump the analyzer schema (v2): instrument safe-output type extraction, discussion categories, and granular permission scopes — currently empty due to v1 parsing limits.
2. Track size regressions: the high fixed lockfile floor (76 KB min) is worth monitoring; today's −356 KB trim is a positive signal to confirm is intentional.
3. Audit single-engine outliers: the six engines with one workflow each (antigravity, crush, gemini, opencode, pi) may be experimental — confirm they are intentional and maintained.

---

Methodology note: single-script compact JSON analysis. All metrics derived from one analyzer pass over 250 lockfiles producing a compact JSON summary; the report reasons only from that summary plus cached prior-day history.

Generated by 📊 Lockfile Statistics Analysis Agent · 73.7 AIC · ⌖ 15.1 AIC · ⊞ 5K · ◷

• expires on Jun 19, 2026, 1:07 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Lockfile Statistics Analysis Agent.

A newer discussion is available at Discussion #40387.