[lockfile-stats] Lockfile Statistics Audit — 2026-07-05 (258 lockfiles, 29.3 MB)

[github-actions[bot]]

Executive Summary

Analysis of 258 compiled .github/workflows/*.lock.yml files as of 2026-07-05 (0 malformed/skipped).

Metric	Value	Δ vs 2026-07-04	Δ vs 2026-05-20
Lockfiles	258	0	+25
Total size	29.3 MB (30,759,538 B)	+50,571 B	+8,372,479 B
Avg size	119,223 B	+196 B	+23,142 B
Median size	118,042 B	+193 B	+22,956 B
Max size	184,059 B	+2,738 B	+7,365 B
Total jobs	2,086	+15	+663
Total steps	29,809	+73	+5,807
Total scripts	13,389	+40	+1,871

Lockfile count is flat day-over-day, yet total size, jobs, steps, and scripts all crept upward — the compiled output is inflating on recompilation, not because workflows were added.

File Size Distribution

Bucket	Count
100–250 KB	247
50–100 KB	11

Distribution is strikingly uniform: 96% of lockfiles fall in a single 100–250 KB band (min 80,100 B, max 184,059 B), confirming that generated compiler boilerplate dominates file size.

Largest & smallest lockfiles

Largest: smoke-copilot-aoai-entra (184,059), smoke-copilot-aoai-apikey (183,650), smoke-copilot (183,538), smoke-claude (179,345), smoke-copilot-arm (169,939).

Smallest: test-workflow (80,100), example-permissions-warning (81,037), firewall (81,976), codex-github-remote-mcp-test (82,127), hippo-embed (89,093).

Trigger Analysis

Trigger	Workflows
workflow_dispatch	250
schedule	173
pull_request	34
issues	4
issue_comment	2
push	2
workflow_run / discussion / discussion_comment / pr_review_comment	1 each

Top combinations: schedule+workflow_dispatch 169 · workflow_dispatch-only 50 · pull_request+workflow_dispatch 27. Nearly every workflow (250/258, 97%) is manually dispatchable, and 173 are scheduled. Cron slots are well spread with minor doubling-up (9 crons shared by exactly 2 workflows); no cron collision hotspots.

Safe Outputs Analysis

⚠️ Not captured this run. The cached lockfile_stats_v1.py parser ran without PyYAML available (yaml_available:false) and its regex fallback returned empty safe_output_types, discussion_categories, and per-permission maps. For historical context, the 2026-05-20 baseline (older schema) recorded create_discussion and create_issue in all 233 workflows, add_comment 71, create_pull_request 56, and discussion categories audits 68 / announcements 5 / research 2. This is a known parser regression — see Recommendations.

Structural Characteristics

Metric	Min	Avg	Max (workflow)
Jobs / workflow	5	8.09	13 (release)
Steps / workflow	78	115.54	160 (smoke-copilot)

Totals: 2,086 jobs, 29,809 steps, 13,389 run-scripts. Both jobs/wf (8.03→8.09) and steps/wf (115.26→115.54) ticked up vs yesterday.

Permission Patterns

Top-level permissions resolved to {} (empty/none) for all 258 lockfiles in this run's parser; granular per-scope read/write maps were not extractable without PyYAML (same limitation as Safe Outputs above).

Tool & MCP Patterns

Engines: copilot 159 (62%) · claude 60 (23%) · pi 21 · codex 14 · antigravity/crush/gemini/opencode 1 each.

MCP servers (reference frequency): github 5,520 · playwright 126 · sentry 96 · grafana 28 · ruflo 16 · arxiv 6 · deepwiki 6.

Tooling signature: 30+ distinct github::* tools each appear in exactly 120 workflows — a shared default GitHub MCP allow-list baked identically into ~120 compiled workflows.

Timeout Distribution (per job)

Bucket (min)	Jobs
31–60	289
16–30	253
6–15	126
≤5	16
>60	3

Timeouts skew long — the plurality of jobs allow 31–60 min.

Interesting Findings

1. Silent size creep. Same 258 lockfiles as yesterday, yet +50 KB total, +15 jobs, +73 steps, +40 scripts — recompilation alone is inflating generated output.
2. Extreme uniformity. 247/258 files cluster in one 100–250 KB band; the compiler's fixed scaffolding, not workflow logic, sets file size.
3. Copilot dominance. Copilot powers 62% of workflows vs 23% for Claude; the long tail (pi, codex, gemini, crush...) is experimental.
4. A 120-workflow shared toolset. ~30 github::* tools appear in precisely 120 workflows each, evidence of a large default MCP allow-list replicated across the fleet — a size-reduction target.
5. Manual-first, schedule-second. 97% dispatchable + 67% scheduled; schedule+workflow_dispatch is the canonical pattern (169 workflows).

Historical Trends

Over ~7 weeks (2026-05-20 → 2026-07-05): lockfiles 233 → 258 (+11%), total size 22.4 MB → 29.3 MB (+37%), avg size 96 KB → 119 KB (+24%), total steps 24,002 → 29,809 (+24%). Fleet is growing in count and per-file weight; size is outpacing file count, reinforcing finding #1.

Recommendations

1. Investigate compiled-size creep — instrument the compiler to report per-release output-byte deltas; +50 KB/day with no new workflows suggests scaffolding growth worth capping.
2. Fix the analyzer's structured extraction (v2 candidate) — install PyYAML in the analyzer environment (or emit structured markers in lockfiles) so safe_output_types, discussion_categories, and granular permissions are captured again; the current regex fallback silently drops three required sections.
3. Audit the 120-workflow GitHub tool allow-list — if most of the ~30 replicated github::* tools go unused per workflow, trimming the default set would shrink lockfiles fleet-wide.
4. Review long timeouts — 289 jobs permit 31–60 min; validate these reflect real runtime needs rather than copied defaults.

Methodology Note

Single-script compact JSON analysis: one cached analyzer (lockfile_stats_v1.py) parses all lockfiles in a single pass into a ≤50 KB JSON summary; the report reasons only from that summary plus cached daily history — no per-file reads during reporting.

References: §28754001133

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by 📊 Lockfile Statistics Analysis Agent · 62.3 AIC · ⌖ 12.2 AIC · ⊞ 5.2K · ◷

• expires on Jul 6, 2026, 12:39 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Lockfile Statistics Analysis Agent.

A newer discussion is available at Discussion #43873.