[lockfile-stats] Lockfile Statistics Audit — 2026-07-12

[github-actions[bot]]

Executive Summary

Analysis of 256 compiled .github/workflows/*.lock.yml files on 2026-07-12. Total footprint 30.71 MB (avg 117.1 KB/file, median 115.6 KB, range 79.5 KB–181.4 KB); 0 malformed/skipped. Aggregate structure is large and highly uniform: 1,605 jobs, 30,020 steps, 13,561 run-scripts. Compared to the prior snapshot (2026-07-11), the corpus is essentially flat — same count, jobs, steps, and scripts; total bytes grew only +41 KB (+0.13%).

Metric	Value
Lockfiles	256
Total size	30.71 MB
Avg / median	117.1 KB / 115.6 KB
Min / max	79.5 KB (example-permissions-warning) / 181.4 KB (smoke-copilot-aoai-entra)
Malformed skipped	0

File Size Distribution

Bucket	Count
100–250 KB	247
50–100 KB	9

Sizes cluster tightly around ~117 KB — the compiled preamble (safe-output plumbing, MCP setup, permission scaffolding) dominates, so file size tracks feature surface more than authored prompt length. The smoke-* family (Copilot AOAI/Entra/APIKey, Claude, Codex) tops the list at 157–181 KB.

Trigger Analysis

Trigger	Workflows
workflow_dispatch	248
schedule	175
pull_request	34
issues	4
push / workflow_call	2 each
issue_comment	2

Top combinations: schedule+workflow_dispatch (171), workflow_dispatch-only (44), pull_request+workflow_dispatch (27). 97% of workflows expose manual dispatch. Cron schedules are well-distributed to avoid thundering-herd — most fire once daily on staggered off-minutes; a handful use */6/*/4/*/12 hourly cadences and 1-5 weekday windows.

Safe Outputs Analysis

Every workflow ships the baseline safety quartet (noop, missing-tool, missing-data, report-incomplete, create-report-incomplete-issue — 251 each). Beyond the baseline, the actual write intents:

Safe output	Count
create-issue	116
create-discussion	87
add-comment	66
create-pull-request	54
push-repo-memory	36
add-labels	26
upload-asset	25
create-pull-request-review-comment	15
submit-pull-request-review	15
update-issue	11
push-to-pull-request-branch	11

Discussion categories: audits (76), announcements (5), artifacts (2), dev (2), daily-news (1), research (1). Audits dominate discussion output — this workflow is one of them.

Structural Characteristics

Metric	Min	Max	Avg
Jobs / workflow	4	12	6.27
Steps / workflow	79	163	117.3

Totals: 1,605 jobs, 30,020 steps, 13,561 run-scripts. Most-jobs: release.lock.yml (12). Most-steps: smoke-copilot.lock.yml (163). The ~117 steps/workflow floor reflects generated boilerplate common to all compiled agents.

Permission Patterns

Scope	Read	Write
contents	256	131
actions	256	4
issues	219	249
pull-requests	225	123
discussions	50	92
security-events	14	3
copilot-requests	—	67

Read is broad-and-uniform (actions+contents on all 256); write is scoped to intent — issues:write (249) and contents:write (131) lead. Notably more workflows request discussions:write (92) than discussions:read (50), consistent with write-mostly audit/report publishers.

Tool & MCP Patterns

Engines: other 115, copilot 64, claude 60, codex 14, then antigravity/gemini/opencode (1 each). ("other" = engine not matched by comment marker; likely default/Claude-family compiles.)

MCP servers: github (100) is near-universal; serena (24) is the notable second (code navigation). Long tail of specialized servers: tavily/sentry (5), grafana/markitdown (3), and single-use semgrep, context7, agentdb, memory, notion, datadog, arxiv, deepwiki.

Timeouts: every workflow caps a job in the 31–60 min band; 28 also have 6–15 min jobs; 2 have ≤5 min jobs.

Interesting Findings

1. Uniformity is the signal. 247/256 files sit in one 100–250 KB bucket and every file carries ~117 steps — the compiler emits a heavy, consistent scaffold, so per-workflow size variance (±30%) comes almost entirely from feature toggles (extra MCP servers, more safe-output types), not prompt authoring.
2. Write exceeds read for discussions. 92 workflows can write discussions but only 50 request read — the corpus is dominated by publish-only reporters (audits/announcements) that never consume prior threads.
3. serena is the breakout non-GitHub MCP. At 24 workflows it's the only third-party server in double digits, signaling meaningful investment in semantic code navigation beyond the GitHub API.
4. Smoke tests are the heavyweights. The six largest files are all smoke-* engine matrices (Copilot AOAI variants, Claude, Codex) at 157–181 KB — cross-engine test surface costs the most compiled bytes.
5. Baseline safety is universal but ~5 files lack it. 251/256 carry the full noop/missing-tool/report-incomplete quartet — a small cohort of 5 compiles without the standard safety outputs and may warrant review.

Historical Trends

Day-over-day vs 2026-07-11 — the corpus is stable:

Metric	2026-07-11	2026-07-12	Δ
Lockfiles	256	256	+0
Total bytes	30,664,408	30,705,490	+41,082 (+0.13%)
Avg bytes	119,783	119,943	+160
Jobs / steps / scripts	1605 / 30020 / 13561	1605 / 30020 / 13561	+0 / +0 / +0

Engine mix, safe-output counts, discussion categories, and MCP usage are unchanged from the prior day. The +41 KB delta reflects minor edits to existing lockfiles rather than any added workflow. History spans 2026-05-20 → 2026-07-12 (52 snapshots); the count grew from the low-200s in late May to a stable 256 through July.

Recommendations

1. Audit the 5 workflows missing the safety quartet — confirm the omission of report-incomplete/missing-tool is intentional; these tools are the primary guard against silent no-op runs.
2. Trim the smoke-* compiled surface — the six ~180 KB smoke matrices dominate corpus bytes; if the engine variants share a template, consider a matrix strategy to reduce duplicated compiled scaffold.
3. Right-size discussion read permissions — reporters requesting discussions:write without read are correctly scoped; keep enforcing least-privilege as new audit workflows are added.
4. Keep staggering crons — the off-minute distribution is healthy; continue avoiding :00/:30 marks as the schedule count (175) grows to prevent runner contention.

Methodology

Single-script compact JSON analysis: one cached Python analyzer (lockfile_stats_v1.py, PyYAML safe_load primary with regex fallback for safe-outputs/permissions/categories) parsed all 256 lockfiles in one pass into a ~7 KB summary JSON; all figures above derive from that summary and a diff against the prior day's cached snapshot. No individual lockfile was opened for analysis outside the analyzer. yaml_available: true, 0 files skipped.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by 📊 Lockfile Statistics Analysis Agent · 55.4 AIC · ⌖ 12.4 AIC · ⊞ 5.3K · ◷

• expires on Jul 13, 2026, 12:33 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Lockfile Statistics Analysis Agent.

A newer discussion is available at Discussion #45325.