[lockfile-stats] Lockfile Statistics Audit — 2026-07-20

[github-actions[bot]]

Executive Summary

Analysis of 260 .github/workflows/*.lock.yml files on 2026-07-20 (0 malformed/skipped).

Metric	Value
Lockfiles	260
Total size	33.75 MB (33,746,194 B)
Avg / median size	126.8 KB / 125.6 KB
Min / max size	80.0 KB / 202.1 KB
Total jobs / steps / scripts	1,841 / 33,212 / 14,777
YAML parser	yaml.safe_load (available)

File Size Distribution

Bucket	Count
100–250 KB	254
50–100 KB	6

Largest: smoke-copilot (202 KB), smoke-copilot-aoai-entra (186 KB), smoke-claude (180 KB). Smallest: example-permissions-warning (80 KB), firewall (81 KB). The near-uniform 100–250 KB band reflects the shared compiled runtime boilerplate every lockfile carries.

Trigger Analysis

Trigger	Count
workflow_dispatch	253
schedule	178
pull_request	31
issues	4
push / workflow_call	2 each
issue_comment	2

Top combinations: schedule+workflow_dispatch (174), workflow_dispatch alone (47), pull_request+workflow_dispatch (26). Nearly every workflow (253/260) exposes manual dispatch; 178 run on cron. Cron cadence skews to daily * * * and weekday 1-5 windows, with a handful of */6/*/4/*/12 high-frequency schedules.

Safe Outputs Analysis

Baseline safety tools (report-incomplete, missing-data, missing-tool, noop) appear in 255/260 lockfiles. Beyond baseline, the active write surface:

Safe output	Count
create-issue	120
create-discussion	88
add-comment	66
create-pull-request	53
push-repo-memory	36
add-labels	25
upload-asset	25
create-pull-request-review-comment	15
submit-pull-request-review	15
update-issue	10

Discussion categories: audits (77), announcements (5), artifacts (2), dev (2), daily-news (1), research (1) — the audit corpus dominates discussion output.

Structural Characteristics

Metric	Min	Avg	Max
Jobs / workflow	4	7.08	12 (release)
Steps / workflow	79	127.7	189 (smoke-copilot)

Scripts (run steps) total 14,777 (~57/workflow). The 79-step floor confirms a heavy fixed compilation scaffold shared across all lockfiles.

Permission Patterns

Read (top): actions 260, contents 260, pull-requests 226, issues 222, discussions 50, security-events 14.

Write (top): issues 253, contents 174, pull-requests 123, discussions 93, copilot-requests 67, checks 13.

Universal actions+contents read is expected. Write-issues on 253/260 is broad; contents-write on 174 warrants periodic least-privilege review.

Tool & MCP Patterns

MCP server	Count
github	100
serena	24
tavily	5
sentry	5
grafana	3
markitdown	3
brave-search / ast-grep / arxiv / notion / datadog	2 each

Engines: copilot 64, claude 63, codex 15, gemini/antigravity/opencode 1 each; 115 unresolved ("other") — see findings.

Timeouts

31–60 min on all 260 jobs (default runtime cap); 6–15 min on 28 jobs, <=5 min on 2.

Interesting Findings

1. Engine detection gap — 115/260 lockfiles resolve to other under regex fallback despite YAML being available. Named engines (copilot/claude/codex) only cover 143; the analyzer's engine heuristic under-classifies nearly half the corpus and should read the compiled engine field directly.
2. Audits dominate discussions — 77 of 88 discussion-emitting workflows target the audits category; this reporting agent is part of a large self-observability fleet.
3. Memory-backed agents growing — push-repo-memory (36) + comment-memory (5) show ~16% of workflows now persist cross-run state.
4. Manual-dispatch is near-universal — 253/260 expose workflow_dispatch, making the fleet almost entirely operator-triggerable on demand.
5. Size floor is structural, not logical — the 80 KB minimum and 79-step floor mean the smallest agent still ships a large fixed runtime; true per-agent logic is a thin slice atop shared scaffold.

Historical Trends (vs 2026-07-19)

Metric	07-19	07-20	Δ
Lockfiles	258	260	+2
Total bytes	32.35 MB	33.75 MB	+1.40 MB
Jobs	1,698	1,841	+143
Steps	31,309	33,212	+1,903
Scripts	14,059	14,777	+718
Avg size	122.4 KB	126.8 KB	+4.4 KB
claude engine	61	63	+2
create-issue	118	120	+2
github MCP	99	100	+1

Steady daily growth: +2 workflows added ~1.4 MB and ~1,900 steps, consistent with new Claude-engine issue-creating agents.

Recommendations

1. Fix engine classification — parse the compiled engine identifier directly rather than regex-matching, to eliminate the 115 other bucket in future audits.
2. Audit contents-write scope — 174 workflows hold contents: write; confirm each genuinely commits or pushes.
3. Track shared-scaffold size — with total size rising ~1.4 MB/day, monitor whether per-workflow boilerplate can be trimmed to slow corpus growth.
4. Consolidate cron windows — many near-unique daily crons could be batched to reduce concurrent runner contention.

Methodology

Single-script compact JSON analysis: one cached Python analyzer (lockfile_stats_v1.py, yaml.safe_load primary with regex fallback for safe-output/permission/category fields) parsed all 260 lockfiles in one pass, emitting a ~7 KB summary; the report reasons only from that JSON. 0 lockfiles skipped.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by 📊 Lockfile Statistics Analysis Agent · 47.4 AIC · ⌖ 12.5 AIC · ⊞ 5.5K · ◷

• expires on Jul 21, 2026, 12:44 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Lockfile Statistics Analysis Agent.

A newer discussion is available at Discussion #47139.