[lockfile-stats] Lockfile Statistics Report — 2026-06-20

[github-actions[bot]]

Analysis of 249 compiled .github/workflows/*.lock.yml files. 0 malformed/skipped. Total compiled size 29.04 MB.

Metric	Value
Lockfiles	249
Total size	29,039,608 bytes (≈27.7 MiB)
Avg / Median	116,624 B / 115,667 B
Min / Max	78,206 B / 174,194 B
Total jobs / steps / scripts	2,000 / 28,130 / 12,555

File Size Distribution

Bucket	Count
100–250 KB	233
50–100 KB	16

Largest: smoke-copilot-aoai-entra (174 KB), smoke-copilot-aoai-apikey (174 KB), smoke-copilot (173 KB). Smallest: test-workflow (78 KB), example-permissions-warning (79 KB), firewall (80 KB). Smoke/test harness workflows dominate the high end.

Trigger Analysis

Trigger	Count
workflow_dispatch	241
schedule	167
pull_request	33
issues	4
issue_comment	2
push	2

Top combinations: schedule+workflow_dispatch (163), workflow_dispatch only (48), pull_request+workflow_dispatch (26). 97% of workflows expose manual dispatch; 67% are scheduled. Cron cadence is well-spread across off-peak minutes (no :00/:30 clustering) — 30 distinct schedules, several daily and */6h cycles.

Structural Characteristics

Metric	Min	Avg	Max
Jobs / workflow	5	8.03	12 (firewall-escape)
Steps / workflow	76	112.97	151 (smoke-copilot)

Scripts (heredoc/embedded) total 12,555, avg ~50/workflow — reflecting the generated, self-contained nature of compiled lockfiles.

Timeout Distribution

Bucket (min)	Jobs
≤5	16
6–15	120
16–30	267
31–60	279
>60	2

Engine & MCP Patterns

Engine	Count
copilot	156
claude	56
pi	19
codex	14
antigravity / crush / gemini / opencode	1 each

MCP server references (raw occurrences across lockfiles): github 5,824 · playwright 126 · sentry 96 · grafana 28 · ruflo 16 · arxiv 6 · deepwiki 6. GitHub MCP is near-universal; ~112 workflows each reference the full read-only GitHub toolset (get_*/list_*).

Historical Trends (vs 2026-06-19)

Metric	2026-06-19	2026-06-20	Δ
Lockfiles	250	249	−1
Total bytes	29,357,567	29,039,608	−317,959
Avg size	117,430	116,624	−806
Total jobs	2,009	2,000	−9
Total steps	28,282	28,130	−152
Total scripts	12,540	12,555	+15
Engine: copilot	167	156	−11
Engine: claude	64	56	−8
Engine: pi	1	19	+18
MCP github refs	6,656	5,824	−832

Interesting Findings

1. pi engine surged 1→19 day-over-day while copilot (−11) and claude (−8) both contracted — a notable engine-mix shift worth confirming as intentional.
2. Manual dispatch is effectively standard: 241/249 (97%) workflows include workflow_dispatch, and only 8 lack it.
3. Compiled footprint shrank ~318 KB despite only one fewer lockfile, driven by a lower max (177.7 KB → 174.2 KB) — smoke harnesses got slightly leaner.
4. Timeouts skew generous: 86% of jobs allow ≥16 min; only 2 jobs exceed 60 min — bounded but not aggressive.
5. GitHub MCP read surface is uniform: ~112 workflows each pull in the identical 30+ read-only GitHub tool list, suggesting a shared default toolset template.

Recommendations

• Confirm the pi engine adoption spike is intended; if experimental, consider gating those workflows behind a label/branch to avoid scheduled-run cost.
• The uniform 112-workflow GitHub read-toolset suggests an opportunity to trim per-workflow tool allow-lists to only what each agent uses, reducing lockfile size and prompt surface.
• Smoke/test harnesses (170+ KB) account for the size ceiling; periodic review keeps total compiled footprint in check.

Methodology

Single-script compact JSON analysis: one cached Python analyzer (lockfile_stats_v1.py) parsed all 249 lockfiles in one pass, emitting a compact (~4.8 KB) summary; all reasoning derives from that JSON plus the prior day's cached summary. Caveat: PyYAML was unavailable in this run, so safe-output-type, discussion-category, and per-key permission breakdowns relied on text matching and returned empty — these dimensions are not reliable in this report and should be treated as unavailable, not zero.

References: §27883245330

Generated by 📊 Lockfile Statistics Analysis Agent · 70 AIC · ⌖ 12.9 AIC · ⊞ 5K · ◷

• expires on Jun 21, 2026, 12:45 PM UTC-08:00