[lockfile-stats] Lockfile Statistics Analysis — 2026-07-23

[github-actions[bot]]

Aggregate analysis of all 261 compiled workflow lockfiles (.github/workflows/*.lock.yml). 0 malformed/skipped. YAML parsing available; safe-output, permission, and category stats via structural + regex detection.

Metric	Value	Δ vs 07-22
Lockfiles	261	+1
Total size	31.8 MB (33,307,795 B)	−0.56 MB
Avg size	124.6 KB	−2.6 KB
Median size	123.8 KB	—
Total jobs	1,848	+7
Total steps	33,437	+116
Total run-scripts	14,828	+49

File size distribution

Bucket	Count
100–250 KB	255
50–100 KB	6

Range: 78.5 KB → 200 KB. Largest are the multi-engine smoke tests; smallest are focused config/auth probes.

Largest & smallest lockfiles

Largest: smoke-copilot (200KB), smoke-copilot-aoai-entra (184KB), smoke-copilot-aoai-apikey (183KB), smoke-claude (177KB), smoke-copilot-arm (169KB), smoke-codex (159KB), issue-monster (156KB), daily-performance-summary (153KB), mcp-inspector (152KB), daily-code-metrics (150KB).

Smallest: example-permissions-warning (78KB), codex-github-remote-mcp-test (79KB), firewall (79KB), hippo-embed (86KB), daily-max-ai-credits-test (88KB), daily-credit-limit-test (95KB), ai-moderator (98KB).

Trigger analysis

Trigger	Workflows
workflow_dispatch	254 (97%)
schedule	179
pull_request	31
issues	4
workflow_call / issue_comment	2 each

Top combinations: schedule+workflow_dispatch (176), workflow_dispatch only (47), pull_request+workflow_dispatch (26). Nearly every workflow keeps a manual-dispatch escape hatch. 179 scheduled workflows across ~99 distinct cron expressions — well-spread minutes (few :00/:30 collisions), mostly daily and weekday (* * 1-5) cadences with a cluster of */6h jobs.

Safe outputs analysis

Baseline safety scaffolding (noop, missing-tool, missing-data, report-incomplete, create-report-incomplete-issue) appears in 256 workflows — the near-universal floor. Real side-effecting outputs:

Safe output	Workflows
create-issue	121
create-discussion	88
add-comment	66
create-pull-request	53
push-repo-memory	36
upload-asset	25
add-labels	25
create-pull-request-review-comment	15
submit-pull-request-review	15
push-to-pull-request-branch	11

Discussion categories: audits dominates (77), then announcements (5), artifacts/dev (2 each), daily-news & research (1 each).

Structural characteristics

Metric	Min	Avg	Max
Jobs / workflow	4	7.1	12 (release)
Steps / workflow	79	128.1	190 (smoke-copilot)

14,828 inline run-scripts total (~57/workflow) — the compiled lockfiles are step-heavy by design.

Permission patterns

Read (top): actions 261, contents 261 (universal), pull-requests 226, issues 223, discussions 50, security-events 14.

Write (top): issues 254, contents 175, pull-requests 123, actions 97, discussions 93, copilot-requests 68.

Read-contents/actions is universal; issues:write is the most common write grant (254), consistent with the safety scaffolding that files incident issues.

Tool & MCP patterns

Engines: other/unclassified 114, copilot 66, claude 63, codex 15, plus single instances of antigravity, gemini, opencode.

MCP servers: github 101 (dominant), serena 24, tavily 5, sentry 5, grafana 3, markitdown 3; long tail of brave-search, ast-grep, arxiv, deepwiki, notion, datadog, semgrep, context7, memory.

Timeouts: 261 workflows in the 31–60 min band (near-universal ceiling), 28 in 6–15 min, 2 ≤5 min, 1 >60 min.

Interesting findings

1. Safety floor is universal. 256/261 workflows carry the full noop/missing-*/report-incomplete scaffolding — the platform enforces a graceful-degradation contract before any workflow ships.
2. Manual override is near-universal. 254/261 expose workflow_dispatch; only 7 workflows cannot be triggered by hand.
3. Discussions are effectively an audit channel. 77 of 88 create-discussion workflows target the audits category — reporting/observability is the dominant discussion use case (this workflow included).
4. Smoke tests are the heavyweights. The 6 largest lockfiles are all multi-engine smoke tests (159–200 KB); they carry the most steps (up to 190) due to matrix expansion.
5. GitHub MCP is the backbone. github MCP appears in 101 workflows — 4× the next server (serena, 24). External data/search MCPs remain a thin long tail.

Historical trends (vs 2026-07-22)

Growth is steady and incremental: +1 lockfile, +7 jobs, +116 steps, +49 scripts, +1 scheduled and +1 dispatch workflow, +1 create-issue consumer, +1 github MCP user. Total bytes fell 1.7% (−0.56 MB) and avg size dropped 2.6 KB despite the added workflow — suggesting a compilation/output slimming alongside net additions. Engine mix and category distribution are otherwise flat.

Recommendations

• Audit cron spread periodically. 179 scheduled workflows share ~99 cron slots; minutes are well-distributed today, but as count grows keep nudging new jobs off :00/:30 to avoid fleet-wide API bursts.
• Watch the timeout ceiling. 261 workflows sit in the 31–60 min band. If real runtimes are far below, tightening timeout-minutes would cut wasted runner-minutes on hangs.
• Track the other engine bucket (114). It's the single largest engine class and unclassified — worth confirming it maps to expected engines rather than a detection gap.
• Keep the safety floor enforced. The 5 workflows missing full scaffolding are worth a quick check for parity.

Methodology note

Single-script compact JSON analysis: one cached Python analyzer (lockfile_stats_v1.py, PyYAML safe_load + structural/regex fallback) parsed all 261 lockfiles in one pass, emitting a ~7 KB summary JSON. All figures above derive from that summary; no per-file inspection was performed during reporting. Prior-day deltas computed against the cached history/2026-07-22.json snapshot.

Generated by 📊 Lockfile Statistics Analysis Agent · age00 · 79.1 AIC · ⌖ 12.3 AIC · ⊞ 5.5K · ◷

• expires on Jul 24, 2026, 12:39 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Lockfile Statistics Analysis Agent.

A newer discussion is available at Discussion #47858.