[lockfile-stats] Lockfile Statistics Analysis — 2026-07-22

[github-actions[bot]]

Aggregate analysis of 260 compiled agentic workflows (.github/workflows/*.lock.yml). 0 files skipped/malformed. YAML parse: ✅.

Metric	Value
Lockfiles analyzed	260
Total size	33.88 MB (33,881,712 B)
Avg / Median size	130.3 KB / 129.4 KB
Min / Max size	82.1 KB / 208.0 KB
Total jobs / steps	1,841 / 33,321
Total run (script) steps	14,779

File Size Distribution

Bucket	Count
100–250 KB	254
50–100 KB	6

Compiled lockfiles are large and tightly clustered (~130 KB avg) — the fixed runtime scaffolding (safe-output plumbing, engine harness) dominates size regardless of source workflow complexity.

Largest & smallest

Largest: smoke-copilot (208 KB), smoke-copilot-aoai-entra (191 KB), smoke-copilot-aoai-apikey (190 KB), smoke-claude (184 KB), smoke-copilot-arm (176 KB).

Smallest: example-permissions-warning (82 KB), codex-github-remote-mcp-test (83 KB), firewall (83 KB), hippo-embed (90 KB), daily-max-ai-credits-test (93 KB).

Trigger Analysis

Trigger	Count
workflow_dispatch	253
schedule	178
pull_request	31
issues	4
issue_comment	2
workflow_call	2
others (push, discussion, workflow_run, deployment_status...)	1 each

Top combinations: schedule+workflow_dispatch (175), workflow_dispatch only (47), pull_request+workflow_dispatch (26). Scheduled cron jobs are heavily jittered across minutes/hours (97 distinct crons) — good fleet-wide load spreading; most run daily (* * *) with a weekday (1-5) cohort.

Safe Outputs Analysis

Five safe-output actions are near-universal scaffolding (~255/260 each): report-incomplete, create-report-incomplete-issue, missing-data, missing-tool, noop. Beyond baseline, the primary intended outputs:

Safe output	Workflows
create-issue	120
create-discussion	88
add-comment	66
create-pull-request	53
push-repo-memory	36
upload-asset	25
add-labels	25
create-pull-request-review-comment	15
submit-pull-request-review	15

Discussion categories: audits (77), announcements (5), artifacts (2), dev (2), daily-news (1), research (1).

Structural Characteristics

Metric	Min	Avg	Max
Jobs / workflow	4	7.08	12 (release)
Steps / workflow	79	128.2	190 (smoke-copilot)

High floor (min 79 steps, 4 jobs) confirms substantial fixed compilation overhead per workflow.

Permission Patterns

Read (top): actions 260, contents 260, pull-requests 226, issues 222, discussions 50, security-events 14.

Write (top): issues 253, contents 174, pull-requests 123, actions 97, discussions 93, copilot-requests 67, checks 13.

Every workflow reads actions + contents; issues:write is nearly universal (253) — driven by the ubiquitous incident/report-incomplete safe-output path rather than by intentional issue creation (only 120 truly create issues).

Timeouts

Bucket (min)	Count
31–60	260
6–15	28
≤5	2

Every workflow carries a job in the 31–60 min band (the agent job); shorter bands are auxiliary jobs.

Tool & MCP Patterns

Engines: other/mixed 113, copilot 66, claude 63, codex 15, antigravity 1, gemini 1, opencode 1.

MCP servers: github 100, serena 24, tavily 5, sentry 5, grafana 3, markitdown 3, brave-search 2, ast-grep 2, arxiv 2, deepwiki 2, notion 2, datadog 2, microsoftdocs 2; singletons: semgrep, agentdb, context7, memory.

GitHub MCP is the dominant integration (100 workflows); serena (code navigation) is a distant second at 24.

Interesting Findings

1. Scaffolding dominates size. A 79-step / 4-job floor and 5 near-universal safe-output actions mean lockfiles are ~130 KB regardless of intent — the compiler emits a heavy, uniform runtime envelope.
2. issues:write over-provisioned. 253 workflows request it but only 120 actually create issues; the gap (~133) is the report-incomplete/incident safe-output path silently pulling the scope in.
3. Discussions are audit-centric. 77 of 88 discussion-writing workflows target the audits category — this fleet's discussion surface is overwhelmingly automated reporting, not conversation.
4. Excellent cron jitter. 97 distinct cron expressions across 178 scheduled workflows, with off-round minutes (e.g. 49 14, 23 11) — deliberate avoidance of thundering-herd scheduling.
5. Engine diversity but GitHub-MCP monoculture. 7 distinct engines in use, yet integration surface concentrates on GitHub MCP (100) — automation breadth is in reasoning engines, not external tooling.

Historical Trends (vs 2026-07-21)

Metric	2026-07-21	2026-07-22	Δ
Lockfiles	260	260	0
Total bytes	33,807,111	33,881,712	+74,601 (+0.22%)
Avg size	130,027	130,314	+287
Total steps	33,215	33,321	+106
Script steps	14,780	14,779	−1
Jobs total	1,841	1,841	0

Stable day-over-day: no new/removed workflows; a small step/byte uptick indicates minor edits to existing workflows rather than fleet growth. Engine, MCP, and category distributions are unchanged.

Recommendations

1. Tighten issues:write scope. Audit the ~133 workflows that request issues:write without a create-issue intent; if the scope is only for report-incomplete incidents, consider a narrower dedicated permission or documenting the coupling.
2. Track the size floor. With a ~79-step / ~130 KB minimum driven by scaffolding, monitor whether compiler changes move the floor — it is the single largest lever on total fleet size (33.9 MB).
3. Consolidate near-duplicate smoke workflows. The five largest files are smoke-copilot* variants (176–208 KB); shared matrix configuration could reduce duplication.
4. Keep the cron jitter discipline. Current spreading is healthy; enforce off-round minutes for any newly added scheduled workflows.

---

Methodology: single-script compact JSON analysis. All .lock.yml files parsed once via PyYAML (yaml.safe_load) into a compact summary; report derived solely from that summary + prior-day cached summary. No per-file inspection during reporting.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by 📊 Lockfile Statistics Analysis Agent · age00 50.5 AIC · ⌖ 12.3 AIC · ⊞ 5.5K · ◷

• expires on Jul 23, 2026, 12:46 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Lockfile Statistics Analysis Agent.

A newer discussion is available at Discussion #47664.