[lockfile-stats] Lockfile Statistics Audit — 2026-08-04

[github-actions[bot]]

Executive Summary

Metric	Value
Lockfiles analyzed	273
Malformed/skipped	0
Total size	37,378,078 bytes (~35.65 MB)
Avg / Min / Max size	136,916 / 81,160 / 214,806 bytes
Total jobs	2,025 (avg 7.42/workflow, max 14)
Total steps	36,513 (avg 133.75/workflow, max 191)
Total script (run) steps	25,055 (avg 91.78/workflow, max 127)
Report date	2026-08-04

File Size Distribution

Largest: smoke-copilot-aoai-entra (214.8 KB), smoke-copilot (213.9 KB), smoke-copilot-aoai-apikey (212.3 KB), deep-report (186.4 KB), smoke-claude (183.8 KB)

Smallest: notion-issue-summary (81.2 KB), example-permissions-warning (81.4 KB), codex-github-remote-mcp-test (81.9 KB), firewall (82.3 KB), hippo-embed (88.2 KB)

Smoke-test workflows for multi-engine/multi-auth configurations dominate the largest end — likely due to duplicated per-engine setup boilerplate compiled into a single lockfile.

Trigger Analysis

Trigger	Count	% of 273
workflow_dispatch	266	97.4%
schedule	186	68.1%
pull_request	35	12.8%
issues	4	1.5%
issue_comment	2	0.7%
workflow_call	2	0.7%
deployment_status, workflow_run, discussion, discussion_comment, push	1 each	0.4%

Top trigger combinations: schedule + workflow_dispatch (183, 67.0%), workflow_dispatch only (48, 17.6%), pull_request + workflow_dispatch (30, 11.0%).

Cron frequency: mostly unique daily times; 11 crons repeat exactly twice (e.g. 49 14 * * 1-5, 23 11 * * *), suggesting light scheduling collisions rather than a shared time-slot convention.

Safe Outputs Analysis

The safety-net output types (missing_data, missing_tool, noop, report_incomplete, create_report_incomplete_issue) appear in 267/273 workflows (97.8%) — this is baked-in scaffolding present in nearly every compiled workflow, not an opt-in feature.

Safe output type	Count
create_issue	129
create_discussion	91
add_comment	69
create_pull_request	55
push_repo_memory	36
add_labels	27
upload_asset	26
mentions	22
create_pull_request_review_comment / submit_pull_request_review	15 each
upload_artifact	14
create_check_run	13
push_to_pull_request_branch	11
update_issue	10

Discussion categories (of 91 discussion-enabled workflows): audits 78 (85.7%), announcements 5, artifacts 2, dev 2, research 2, general 1, daily-news 1. This report itself lands in audits, the dominant category.

Structural Characteristics

• Jobs/workflow: avg 7.42, max 14
• Steps/workflow: avg 133.75, max 191
• Script steps/workflow: avg 91.78, max 127 — roughly 68% of all steps are inline run: scripts
• Timeout-minutes declared explicitly on only 304 of 2,025 jobs (15%): 45min (273 jobs), 10min (29), 5min (2) — the remaining 85% of jobs rely on GitHub Actions' default timeout

Permission Patterns

Read	Count		Write	Count
contents	1,203		issues	614
actions	653		contents	391
pull-requests	242		pull-requests	302
issues	231		copilot-requests	210
discussions	50		discussions	189
security-events	14		actions	109

copilot-requests: write appearing 210 times aligns closely with the 167 Copilot-engine workflows plus overlap from other engines invoking Copilot APIs.

Tool & MCP Patterns

Engine distribution: copilot 167 (61.2%), claude 65 (23.8%), pi 21 (7.7%), codex 15 (5.5%), aider/antigravity/gemini/goose/opencode 1 each (0.4%).

MCP servers: safeoutputs 134, github 87, agenticworkflows 40, mcpscripts 4, mempalace/graft/agentdb/ast-grep/ruflo/arxiv/datadog 1 each.

Interesting Findings

1. Copilot leads the engine mix (61%) despite this being an Anthropic-tooling repo — Claude is second at 24%, with pi/codex/others as a long tail.
2. Near-universal safe-output scaffolding: 98% of workflows carry the same five defensive output types (noop/missing_data/missing_tool/report_incomplete family), indicating a standardized error-handling contract enforced by the compiler rather than per-workflow authoring.
3. "audits" dominates discussion output (86% of discussion-producing workflows), suggesting this report's category is the primary discussion sink for the whole fleet, not a niche choice.
4. schedule + workflow_dispatch is the default trigger shape (67%) — the fleet is overwhelmingly built as scheduled autonomous agents with a manual-run escape hatch, not event-driven automation.
5. Explicit timeouts are rare (only 15% of jobs declare timeout-minutes), and when present cluster tightly at 45 minutes (273 of 304), implying a single shared default rather than per-workflow tuning.

Historical Trends

No prior summary found in /tmp/gh-aw/cache-memory/history/ — this is the first recorded baseline (2026-08-04). Future runs will diff against this snapshot.

Recommendations

• Consider adding explicit timeout-minutes to the 85% of jobs currently relying on GitHub's default, to bound runaway agent jobs more predictably.
• The heavy duplication driving the largest lockfiles (smoke-* multi-engine variants at 200KB+) may be a candidate for shared-template extraction if compiled size becomes a repo-size concern.
• Given copilot is now the majority engine, ensure documentation/examples default-reference Copilot alongside Claude where the two diverge in configuration.

Methodology

single-script compact JSON analysis

Generated by 📊 Lockfile Statistics Analysis Agent · agent · 54.8 AIC · ⌖ 12.3 AIC · ⊞ 5.9K · ◷

• expires on Aug 5, 2026, 12:49 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Lockfile Statistics Analysis Agent.

A newer discussion is available at Discussion #50691.