[lockfile-stats] Lockfile Statistics Audit — 2026-07-19

[github-actions[bot]]

Aggregate analysis of 258 compiled .github/workflows/*.lock.yml files. Parser: PyYAML.safe_load (yaml_available: true), 0 malformed/skipped.

Metric	Value
Lockfiles	258
Total size	30.85 MB (32,349,305 B)
Avg / median	122.4 KB / 120.2 KB
Min / max	79.8 KB (example-permissions-warning) / 202.1 KB (smoke-copilot)
Jobs (total / avg / max)	1,698 / 6.6 / 12 (release)
Steps (total / avg / max)	31,309 / 121.4 / 189 (smoke-copilot)
Run-script steps (total)	14,059

File size distribution

Bucket	Count
100–250 KB	250
50–100 KB	8

Sizes are tightly clustered — 97% of lockfiles fall in the 100–250 KB band, reflecting a common compiled scaffold across workflows.

Trigger analysis

Trigger	Workflows
workflow_dispatch	251 (97%)
schedule	177 (69%)
pull_request	31
issues	4
issue_comment	2
push / workflow_call	2 / 2

Top combination	Count
schedule + workflow_dispatch	173
workflow_dispatch only	46
pull_request + workflow_dispatch	26

Cron cadence

Of ~100 distinct cron expressions, the vast majority are daily (M H * * *) with jittered minute/hour offsets — very few share an exact minute, and :00/:30 marks are largely avoided. A handful run every 6h (* */6 * * *), weekday-only (* * * 1-5), or weekly. This jitter is good practice: it spreads scheduler load and avoids thundering-herd API bursts.

Safe outputs analysis

A baseline safety floor of 5 built-in outputs appears in 253/258 workflows: noop, missing-tool, missing-data, report-incomplete, create-report-incomplete-issue. Opt-in action outputs:

Safe output	Workflows
create-issue	118
create-discussion	88
add-comment	66
create-pull-request	53
push-repo-memory	36
upload-asset	25
add-labels	25
create-pull-request-review-comment	15
submit-pull-request-review	15
create-check-run	13
push-to-pull-request-branch	11
update-issue	10

Discussion categories: audits 77, announcements 5, artifacts 2, dev 2, daily-news 1, research 1.

Permission patterns

Scope	read	write
contents	258	145
actions	258	4
issues	220	251
pull-requests	226	123
discussions	50	93
security-events	14	3
copilot-requests	—	67

Every lockfile requests contents:read + actions:read. issues is the most-written scope (251) — writes exceed reads because most workflows report via issues without needing to read them. discussions also skews write-heavy (93 write vs 50 read).

Tool & MCP patterns

MCP server	Workflows
github	99
serena	24
tavily	5
sentry	5
grafana / markitdown	3 / 3
brave-search / ast-grep / arxiv / deepwiki / notion / datadog / microsoftdocs	2 each

github dominates (99); a long tail of specialized servers covers search, code-analysis, observability, and docs.

Engine distribution (heuristic): copilot 64, claude 61, codex 15, gemini/antigravity/opencode 1 each; other/undetected 115. The other bucket is large because engine tagging is inferred from compiled text — see caveats.

Timeouts: all 258 jobs fall in the 31–60 min band; 28 additional jobs at 6–15 min, 2 at ≤5 min.

Interesting findings

1. Growth is per-workflow, not just per-count. Since 2026-05-20, lockfile count rose +11% (233→258) but total bytes rose +44% (22.4→32.3 MB). Average step count is climbing — the compiler is emitting more scaffold per workflow, not just more workflows.
2. Near-universal manual escape hatch. 97% (251) expose workflow_dispatch, and 173 pair it with schedule — every scheduled agent can also be triggered on demand.
3. A consistent safety scaffold. 253/258 carry the same 5 fail-safe outputs; the 5 without them are non-agentic utility workflows (e.g. release/changeset).
4. Cron jitter is disciplined. Distinct minute offsets and avoidance of :00/:30 show intentional load-spreading across ~177 scheduled workflows.
5. Write-skewed on issues, read-skewed on PRs. Workflows write issues far more than they read them (251 vs 220), while PR access is more balanced (226 read / 123 write).

Historical trends

Date	Lockfiles	Total MB	Jobs	Steps	Scripts
2026-05-20	233	22.39	—	—	—
2026-06-19	250	29.36	2,009	28,282	12,540
2026-07-12	256	30.71	1,605	30,020	13,561
2026-07-18	258	32.35	1,698	31,308	14,058
2026-07-19	258	32.35	1,698	31,309	14,059

Day-over-day (vs 07-18): flat — +1 step, +1 script, +30 B (a single minor workflow edit). Week-over-week (vs 07-12): +2 lockfiles, +1.64 MB, +1,289 steps, +498 scripts — meaningful per-workflow scaffold growth.

Recommendations

1. Investigate compiled-size inflation. Avg 121 steps/workflow and +44% total bytes in two months suggest boilerplate accumulation. Extracting shared setup into reusable composite actions could cut per-lockfile size.
2. Audit contents:write. 145 workflows request it; confirm each genuinely mutates the repo rather than inheriting write by default.
3. Improve engine tagging. 115 lockfiles land in the other/undetected engine bucket, limiting observability — emit an explicit engine marker in compiled output.
4. Review the uniform 31–60 min timeout band. Lightweight report-only workflows could adopt tighter ceilings to fail faster and free runners.

Methodology note

Single-script compact JSON analysis: one cached Python analyzer (lockfile_stats_v1.py) parses all lockfiles with PyYAML.safe_load in a single pass, emitting a compact (<7 KB) summary JSON. All figures above derive from that summary only. Engine detection and a subset of safe-output/permission signals use text-pattern fallbacks and are approximate; structural, size, trigger, and permission-map figures are parsed directly from YAML. 0 lockfiles were malformed or skipped.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by 📊 Lockfile Statistics Analysis Agent · 60.9 AIC · ⌖ 12.6 AIC · ⊞ 5.5K · ◷

• expires on Jul 20, 2026, 12:34 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Lockfile Statistics Analysis Agent.

A newer discussion is available at Discussion #46921.