[lockfile-stats] Lockfile Statistics Report — 2026-07-24

[github-actions[bot]]

Executive Summary

Analysis of 261 compiled .github/workflows/*.lock.yml files (0 malformed / skipped) as of 2026-07-24.

Metric	Value
Lockfiles analyzed	261
Total size	34,015,731 bytes (~32.4 MB)
Average size	130,328 B (~127 KB)
Median size	129,396 B (~126 KB)
Min / Max	82,113 B / 208,056 B
Total jobs / steps / scripts	1,848 / 33,437 / 14,828
YAML parse success	261 / 261

Lockfiles are large and remarkably uniform: 255 of 261 (98%) fall in the 100–250 KB band, reflecting a shared compilation template (identical runtime scaffolding, safe-output plumbing, and sanitization steps injected into every workflow).

File Size Distribution

Bucket	Count
50–100 KB	6
100–250 KB	255

Largest & smallest lockfiles

Largest

File	Bytes
smoke-copilot.lock.yml	208,056
smoke-copilot-aoai-entra.lock.yml	190,790
smoke-copilot-aoai-apikey.lock.yml	190,381
smoke-claude.lock.yml	184,038
smoke-copilot-arm.lock.yml	175,622
smoke-codex.lock.yml	165,415
issue-monster.lock.yml	163,234

Smallest

File	Bytes
example-permissions-warning.lock.yml	82,113
codex-github-remote-mcp-test.lock.yml	83,036
firewall.lock.yml	83,052
hippo-embed.lock.yml	90,060
daily-max-ai-credits-test.lock.yml	92,658

Trigger Analysis

Trigger	Workflows
workflow_dispatch	254
schedule	179
pull_request	31
issues	4
issue_comment / workflow_call	2 / 2
push / discussion / workflow_run / others	1 each

Top trigger combinations: schedule + workflow_dispatch (176), workflow_dispatch only (47), pull_request + workflow_dispatch (26).

Nearly every workflow (254/261, 97%) exposes manual workflow_dispatch, and 179 run on a schedule — the corpus is dominated by scheduled+manually-triggerable agents. Cron cadences are heavily spread (near-unique minute offsets across 100+ crons) and skew to daily (* * *) and weekday (1-5) runs, indicating deliberate load-spreading to avoid thundering-herd scheduling.

Safe Outputs Analysis

Runtime-injected guards appear in essentially all workflows (noop, missing-data, missing-tool, report-incomplete, create-report-incomplete-issue: 256 each). Author-declared write channels:

Safe output	Workflows
create-issue	121
create-discussion	88
add-comment	66
create-pull-request	53
push-repo-memory	36
upload-asset	25
add-labels	25
create-pull-request-review-comment	15
submit-pull-request-review	15
create-check-run	13
update-issue	10

Discussion categories: audits (77), announcements (5), artifacts (2), dev (2), daily-news (1), research (1) — the audits category (this report's home) is by far the most common publishing target.

Structural Characteristics

Metric	Min	Avg	Max
Jobs / workflow	4	7.08	12
Steps / workflow	79	128.11	190

• Most jobs: release.lock.yml (12)
• Most steps: smoke-copilot.lock.yml (190)
• Total inline scripts: 14,828 (~57 per workflow)

The high floor (min 79 steps, min 4 jobs) confirms a substantial fixed compilation overhead applied uniformly.

Permission Patterns

Scope	Read	Write
actions	261	97
contents	261	175
issues	223	254
pull-requests	226	123
discussions	50	93
security-events	14	3
copilot-requests	—	68

Every workflow gets actions:read + contents:read. Write grants are dominated by issues:write (254) and contents:write (175) — consistent with the issue/PR-authoring nature of the fleet. Notably, 93 workflows have discussions:write but only 88 declare a create-discussion safe output, and 254 hold issues:write — a broad write surface worth periodic least-privilege review.

Tool & MCP Patterns

Engines: other/unclassified 114, copilot 66, claude 63, codex 15, antigravity 1, gemini 1, opencode 1.

MCP servers referenced:

Server	Workflows
github	101
serena	24
tavily	5
sentry	5
grafana / markitdown	3 / 3
brave-search / ast-grep / arxiv / deepwiki / notion / datadog / microsoftdocs	2 each

Timeouts: the 31–60 min band covers all 261 (job-level default); 28 workflows also declare shorter 6–15 min jobs, 2 use ≤5 min, and 1 exceeds 60 min.

Interesting Findings

1. Extreme structural uniformity — 98% of lockfiles sit in a single 100–250 KB band with a min of 79 steps; the compiler emits a heavy, consistent scaffold regardless of the source workflow's complexity.
2. Manual-trigger ubiquity — 97% expose workflow_dispatch; the fleet is designed for both scheduled autonomy and on-demand human invocation.
3. Cron anti-collision — schedule crons use scattered, near-unique minute offsets rather than round :00/:30, evidence of intentional load-spreading across 179 scheduled workflows.
4. Permission vs. usage gap — discussions:write (93) exceeds declared create-discussion outputs (88), and issues:write is held by 254 workflows — a candidate for least-privilege tightening.
5. Engine fragmentation — 114 workflows are unclassified/"other" engine; classification coverage of the engine field could be improved for cleaner fleet telemetry.

Historical Trends (vs. 2026-07-23)

Metric	07-23	07-24	Δ
Lockfiles	261	261	0
Total bytes	33,307,795	34,015,731	+707,936 (+2.1%)
Avg size	127,616	130,328	+2,712 (+2.1%)
Jobs / Steps / Scripts	1,848 / 33,437 / 14,828	1,848 / 33,437 / 14,828	0 / 0 / 0
workflow_dispatch	254	254	0

Trigger mix, engine distribution, safe-output counts, discussion categories, and MCP server usage are identical to the prior day. The only movement is a uniform +2.1% growth in total/average lockfile size with no change in count or structure — consistent with a recompile that enlarged the shared scaffold (e.g., added runtime boilerplate) rather than any authored workflow change.

Recommendations

1. Least-privilege audit — reconcile the issues:write (254) and discussions:write (93 vs. 88 used) grants against actual safe-output declarations; strip unused write scopes.
2. Investigate scaffold growth — the +2.1% size bump across all files with zero structural change suggests boilerplate creep in the compiler; confirm it is intentional.
3. Improve engine classification — 114 "other" engines obscure fleet composition; extend detection so telemetry attributes each workflow to a concrete engine.
4. Track scaffold overhead — with a 79-step floor per workflow, monitor whether the fixed compilation cost is trending up over time.

Methodology

Single-script compact JSON analysis: one cached Python analyzer (lockfile_stats_v1.py) parses all 261 lockfiles with yaml.safe_load in a single pass, emitting a ~7 KB compact JSON summary; the report is derived solely from that summary and a prior-day cached summary for deltas. 261/261 files parsed cleanly (0 skipped).

Generated by 📊 Lockfile Statistics Analysis Agent · age00 · 86.5 AIC · ⌖ 12.8 AIC · ⊞ 5.5K · ◷

• expires on Jul 25, 2026, 12:46 PM UTC-08:00

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-07-25T20:46:16.625Z.

Closed by Workflow