[lockfile-stats] Lockfile Statistics — 2026-07-03

[github-actions[bot]]

Aggregate analysis of 258 compiled .github/workflows/*.lock.yml files (0 malformed/skipped). Total compiled size 29.3 MB (30,699,748 bytes).

Metric	Value	Δ vs 2026-07-02
Lockfiles	258	0
Total bytes	30,699,748	+692,975 (+2.3%)
Avg size	118,991 B (116 KB)	+2,686
Median size	117,804 B	+2,799
Min / Max	80,067 / 181,184 B	+1,899 / +2,799

Every file drifted ~2 KB larger overnight with no change in workflow count — a compiler/template change added shared boilerplate across the board (see step count below).

File size distribution

Bucket	Count	Δ
100–250 KB	247	+4
50–100 KB	11	−4

Largest: smoke-copilot-aoai-entra (177 KB), smoke-copilot-aoai-apikey (177 KB), smoke-copilot (176 KB), smoke-claude (173 KB). Smallest: test-workflow (78 KB), example-permissions-warning (79 KB), firewall (80 KB).

Trigger analysis

Trigger	Count
workflow_dispatch	250
schedule	173
pull_request	34
issues	4
issue_comment	2
push	2

Top combinations: schedule+workflow_dispatch (169), workflow_dispatch only (50), pull_request+workflow_dispatch (27). 250/258 (97%) expose manual dispatch; 173 (67%) are scheduled. Cron cadence is well-distributed (mostly daily at randomized minutes; a handful of */6h and weekday-only 1-5 schedules) — no cron collisions on :00.

Structural characteristics

Metric	Value	Δ
Total jobs	2,071	0
Avg jobs / wf	8.03	0
Max jobs	release (13)	0
Total steps	29,737	+263
Avg steps / wf	115.26	+1.02
Max steps	smoke-copilot (156)	+1
Total run: scripts	13,350	0

The +263 steps with unchanged job/script totals confirms the size growth came from added steps in a shared template, not new workflows or logic.

Engine distribution

Engine	Count
copilot	159
claude	60
pi	21
codex	14
antigravity / crush / gemini / opencode	1 each

Copilot dominates (62%); Claude is the clear second (23%).

Tool & MCP patterns

MCP server	Mentions
github	5,520
playwright	126
sentry	96
grafana	28
ruflo	16
arxiv / deepwiki	6 each

GitHub MCP is near-universal. The top ~30 GitHub tools each appear exactly 120 times, indicating a standardized read-only GitHub toolset shared across a common cohort of workflows.

Timeout distribution

Bucket (min)	Count
31–60	289
16–30	253
6–15	126
≤5	16
>60	3

(Counts are per-job across all lockfiles.)

Interesting findings

1. Uniform overnight growth — all 258 files gained ~2 KB and the step total rose +263 with zero new workflows; a shared compiler/template emitted extra steps.
2. Manual-dispatch is effectively mandatory — 97% of workflows expose workflow_dispatch, making ad-hoc runs a first-class convention.
3. Standardized GitHub toolset — 30 distinct GitHub MCP tools each appear exactly 120×, evidence of a single canonical tool bundle reused verbatim.
4. Smoke tests are the heaviest artifacts — the six largest lockfiles are all smoke-* variants (176–181 KB), 50%+ above the median.
5. Bucket migration — 4 workflows crossed from the 50–100 KB band into 100 KB+ purely from the size drift, shrinking the small-file cohort to 11.

Historical trends

41 daily summaries on record (2026-05-20 → 2026-07-03). Workflow count has held steady at 258 recently; compiled size trends gently upward (+2.3% day-over-day this run), driven by template/step growth rather than new workflows. Job and script totals are flat, so complexity per workflow is stable while boilerplate expands.

Recommendations

• Watch template bloat. A repo-wide +2 KB/file/day is small per run but compounds; if boilerplate steps keep growing, consider factoring shared setup into a composite action to cap lock-file size.
• Audit the smoke-* cluster. The six largest files are near 180 KB; verify their extra steps are all necessary or share a common base.
• Extend the analyzer. The v1 script currently reports empty safe_output_types, discussion_categories, and per-scope permissions (top-level permissions parsed as {} for all 258 files) — a v2 bump should parse the nested permission/safe-output structure to surface those dimensions.

---

Methodology: single-script compact JSON analysis — one Python pass over all 258 lockfiles emits a ≤50 KB JSON summary; the report reasons only from that JSON plus cached daily history. 0 files malformed.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by 📊 Lockfile Statistics Analysis Agent · 50.4 AIC · ⌖ 11.7 AIC · ⊞ 5.2K · ◷

• expires on Jul 4, 2026, 12:39 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Lockfile Statistics Analysis Agent.

A newer discussion is available at Discussion #43433.