[lockfile-stats] Lockfile Statistics Audit — 2026-07-21

[github-actions[bot]]

Overview

Static analysis of all 260 compiled .github/workflows/*.lock.yml files (0 malformed / skipped). Parser: PyYAML.safe_load (yaml_available: true), with regex/job-name fallback for permissions, safe-output types, and discussion categories.

Metric	Value
Lockfiles	260
Total size	33.81 MB (33,807,111 B)
Avg / median	130.0 KB / 128.9 KB
Min / max	82.0 KB / 207.1 KB
Total jobs / steps / run-scripts	1,841 / 33,215 / 14,780
Malformed skipped	0

File size distribution

Bucket	Count
100–250 KB	254
50–100 KB	6

Every lockfile now exceeds 80 KB — compiled artifacts are uniformly large. Largest: smoke-copilot.lock.yml (207 KB), smoke-copilot-aoai-entra (190 KB), smoke-copilot-aoai-apikey (190 KB), smoke-claude (184 KB). Smallest: example-permissions-warning (82 KB), firewall (83 KB), codex-github-remote-mcp-test (83 KB).

Trigger analysis

Trigger	Workflows
workflow_dispatch	253
schedule	178
pull_request	31
issues	4
issue_comment / push / workflow_call	2 each

Top combinations: schedule+workflow_dispatch (174), workflow_dispatch alone (47), pull_request+workflow_dispatch (26). 253 / 260 (97%) expose manual dispatch. 178 are scheduled across ~100 distinct crons — heavily jittered (odd minutes, staggered hours), mostly daily (* * *) with a 1-5 weekday cohort and several */6h fan-outs.

Safe outputs analysis

Baseline runtime outputs appear in ~255 workflows each (noop, missing-tool, missing-data, report-incomplete, create-report-incomplete-issue). Author-selected outputs:

Safe output	Workflows
create-issue	120
create-discussion	88
add-comment	66
create-pull-request	53
push-repo-memory	36
upload-asset	25
add-labels	25
create-pull-request-review-comment	15
submit-pull-request-review	15
create-check-run	13

Discussion categories: audits 77, announcements 5, artifacts 2, dev 2, daily-news 1, research 1. The audits category dominates published output.

Structural characteristics

Metric	Min	Avg	Max
Jobs / workflow	4	7.08	12 (release)
Steps / workflow	79	127.8	189 (smoke-copilot)

Run/script steps total 14,780 (~57 per workflow). Structure is highly uniform — the ~80-step floor reflects shared compiled scaffolding (setup, firewall, safe-output collection) common to every workflow.

Permission patterns

Read (top): actions 260, contents 260, pull-requests 226, issues 222, discussions 50, security-events 14.

Write (top): issues 253, contents 174, pull-requests 123, actions 97, discussions 93, copilot-requests 67, checks 13.

All 260 workflows carry read actions+contents; issue-write is near-universal (253). Least-privilege holds at the tail (id-token 2, attestations/packages/statuses 1 each).

Tool & MCP patterns

Engine mix: other 113, copilot 66, claude 63, codex 15, plus antigravity/gemini/opencode (1 each). MCP servers: github 100, serena 24, tavily 5, sentry 5, grafana 3, markitdown 3; long tail of single-use servers (semgrep, agentdb, notion, datadog, arxiv, deepwiki, context7, memory). GitHub MCP is the overwhelmingly dominant integration.

Interesting findings

1. actions:write surged 4 → 97 in a single day (+93). Same analyzer, same schema — a real change: a large cohort of lockfiles gained actions: write (likely cache-write or workflow-dispatch enablement) in the 07-20→07-21 recompile. Worth confirming this permission expansion was intentional.
2. 97% of workflows are manually dispatchable (workflow_dispatch on 253/260) while 178 also run on schedule — the fleet is designed for both autonomous and on-demand operation.
3. Uniform 80 KB+ floor: the smallest lockfile (82 KB) is still ~40% of the largest (207 KB); compiled scaffolding dominates size, so authored logic is a minority of each artifact.
4. audits is the primary publishing channel (77 of 96 category-tagged discussions), confirming this fleet is audit/reporting-heavy rather than code-mutating.
5. GitHub MCP centrality: 100 workflows wire the GitHub MCP server — 4× the next server (serena, 24); most cross-service integrations are one-offs.

Historical trends

Metric	07-01	07-14	07-20	07-21	Δ day	Δ week
Lockfiles	258	256	260	260	0	+4
Total MB	30.0	31.4	33.75	33.81	+0.06	+2.37 (+7.6%)
Avg KB	116.3	122.8	129.8	130.0	+0.2	+7.2 (+5.9%)
Steps	29,463	30,106	33,212	33,215	+3	+3,109 (+10.3%)
Scripts	13,349	13,604	14,777	14,780	+3	+1,176 (+8.6%)
actions:write	n/a	4	4	97	+93	+93

Day-over-day churn is minimal (+3 steps/scripts, +61 KB) — 07-21 is a near-noop recompile except for the actions:write jump. The week shows steady growth: +7.6% bytes and +10% steps as the fleet and per-workflow scaffolding both expand. (Engine counts pre-07-05 used a different detection heuristic — e.g. copilot=159 on 07-01 — so engine trends are only comparable across recent days.)

Recommendations

1. Audit the actions:write +93 jump. Verify the 07-21 permission expansion is intentional and scoped; actions: write grants workflow/cache mutation and should be justified per workflow.
2. Watch the size trend. +7.6% bytes/week compounds; if compiled scaffolding is the driver, consider shared-artifact deduplication to keep lockfiles reviewable.
3. Re-examine near-universal issue-write (253 workflows) — audit/reporting workflows publishing only discussions may not need issue-write; tightening the tail reduces blast radius.
4. Consolidate single-use MCP servers where a shared server would suffice, reducing per-workflow config surface.

Methodology note

Single-script compact JSON analysis: one cached Python analyzer (lockfile_stats_v1.py) parsed all lockfiles in one pass into a ≤7 KB summary JSON; all reasoning derives from that summary plus dated history snapshots. No per-file inspection outside the analyzer.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by 📊 Lockfile Statistics Analysis Agent · age00 58 AIC · ⌖ 12.4 AIC · ⊞ 5.5K · ◷

• expires on Jul 22, 2026, 12:42 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Lockfile Statistics Analysis Agent.

A newer discussion is available at Discussion #47399.