[lockfile-stats] Lockfile Statistics Analysis — 2026-08-03

[github-actions[bot]]

Lockfile Statistics — 2026-08-03

Analysis of all compiled GitHub Actions workflow lock files (.github/workflows/*.lock.yml) in github/gh-aw. Methodology: single-script compact JSON analysis (cached analyzer, reused from prior run).

Executive summary

Metric	Value
Lockfiles analyzed	269 (0 skipped)
Total size	36,821,810 bytes (~35.1 MB)
Avg / min / max size	136,884 / 81,144 / 214,611 bytes
Total jobs / steps / scripts	2,001 / 36,061 / 15,755

File size distribution

Bucket	Count
100–250 KB	263
50–100 KB	6

Largest: smoke-copilot-aoai-entra.lock.yml (214,611 B), smoke-copilot.lock.yml (213,709 B), smoke-copilot-aoai-apikey.lock.yml (212,097 B)
Smallest: notion-issue-summary.lock.yml (81,144 B), example-permissions-warning.lock.yml (81,357 B), codex-github-remote-mcp-test.lock.yml (81,924 B)

Trigger analysis

Trigger	Files
workflow_dispatch	262
schedule	185
pull_request	33
issues	4
issue_comment	2
workflow_call	2
discussion, discussion_comment, deployment_status, workflow_run, push	1 each

Top combinations: schedule+workflow_dispatch (182), workflow_dispatch only (47), pull_request+workflow_dispatch (28).

Schedule crons are broadly spread across the day (mostly * * * daily, some */6/*/4/*/12 hour steps and weekday-only 1-5 patterns) — no significant clustering at the same minute, consistent with staggered scheduling.

Safe outputs analysis

Type	Files
create-report-incomplete-issue / missing-data / missing-tool / noop / report-incomplete	263 (near-universal safety scaffolding)
create-issue	125
create-discussion	91
add-comment	67
create-pull-request	55
push-repo-memory	36
upload-asset	26
add-labels	25
mentions	22
create-pull-request-review-comment / submit-pull-request-review	15 each
update-issue	10
(35+ other types)	1–8 each

Discussion categories: audits (78), announcements (5), artifacts (2), dev (2), research (2), general (1), daily-news (1).

Structural characteristics

Metric	Min	Avg	Max
Jobs / workflow	4	7.44	14 (release.lock.yml)
Steps / workflow	80	134.06	191 (smoke-copilot.lock.yml)

Total scripts (run steps) across all workflows: 15,755.

Permission patterns

Read grants (top): actions (269), contents (269), pull-requests (230), issues (225), discussions (50), security-events (14).

Write grants (top): issues (269), contents (197), pull-requests (126), actions (99), discussions (96), copilot-requests (74), checks (13).

Every workflow reads actions and contents, and every workflow writes issues — consistent with the universal safe-output scaffolding (issue-based incomplete/missing-tool reporting) seen above.

Tool & MCP patterns

Engine	Workflows
other (custom/unlabeled)	118
copilot	68
claude	65
codex	15
antigravity, gemini, opencode	1 each

MCP servers: github (104), serena (24), tavily (5), sentry (5), grafana (3), ast-grep (2), arxiv (2), deepwiki (2), datadog (2), microsoftdocs (2), agentdb/context7/memory (1 each).

Interesting findings

1. Safety scaffolding is near-universal: 263/269 workflows (98%) carry the full noop/missing-tool/missing-data/report-incomplete safe-output set, indicating a strongly standardized safe-output contract across the fleet.
2. GitHub MCP dominates tool usage: the github MCP server appears in 104 workflows — 4x the next most common (serena, 24) — reflecting how central GitHub read/write access is to this repo's automation.
3. release.lock.yml is the structural outlier: at 14 jobs it has double the average (7.44), suggesting a multi-stage release pipeline distinct from the single-agent-job pattern most workflows follow.
4. Timeout ceiling is nearly universal: all 269 workflows sit in the 31–60 minute timeout bucket except 2 short-timeout (≤5 min) and 29 medium (6–15 min) workflows — the fleet is standardized on long-running budgets.
5. workflow_dispatch is essentially mandatory (262/269, 97%) even though only 185 workflows are scheduled — manual triggering is treated as a near-default regardless of automation cadence.

Historical trends (vs. 2026-08-02)

Metric	2026-08-02	2026-08-03	Δ
Lockfiles	269	269	0
Total bytes	37,395,841	36,821,810	−574,031 (−1.5%)
Avg size (bytes)	139,018	136,884	−2,134
Total jobs	2,000	2,001	+1
Total steps	35,775	36,061	+286
Total scripts	15,748	15,755	+7
Max steps (smoke-copilot.lock.yml)	190	191	+1
issues write grants	267	269	+2
actions write grants	98	99	+1
Timeout 6–15min bucket	28	29	+1
push-repo-memory safe output	37	36	−1
upload-asset safe output	25	26	+1

Overall lockfile fleet is essentially stable day-over-day: a slight net decrease in total compiled size despite a small increase in job/step counts (likely from action-version pin churn or minor recompiles), plus two workflows shifting toward broader write permissions.

Recommendations

• Given release.lock.yml's outlier job count (14 vs avg 7.44), confirm its complexity is intentional (multi-stage release) rather than drift from the standard single-job agentic pattern.
• The near-universal issues: write grant (269/269) combined with heavy safe-output reporting scaffolding is expected, but worth periodically auditing that contents: write (197 workflows) is only granted where a PR/commit safe-output is actually configured.
• Consider trimming the long tail of single-use safe-output types (35+ types used by only 1–2 workflows) if any are legacy/unused, to simplify the safe-output surface area.

Methodology: single-script compact JSON analysis (cached analyzer script lockfile_stats_v1.py, reused from prior run; PyYAML-backed parsing with regex fallback for permissions/safe-outputs/discussion categories).

Generated by 📊 Lockfile Statistics Analysis Agent · agent · 46.5 AIC · ⌖ 12.4 AIC · ⊞ 5.8K · ◷

• expires on Aug 4, 2026, 12:46 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Lockfile Statistics Analysis Agent.

A newer discussion is available at Discussion #50395.