[lockfile-stats] Lockfile Statistics Report — 2026-08-05

[github-actions[bot]]

Executive summary

Metric	Value
Lockfiles analyzed	275 (0 skipped/malformed)
Total size	37,605,664 bytes (~35.9 MB)
Avg / min / max size	136,747 / 81,255 / 214,808 bytes
Report date	2026-08-05

File size distribution

• Largest: smoke-copilot-aoai-entra.lock.yml (214,808 B), smoke-copilot.lock.yml (213,906 B), smoke-copilot-aoai-apikey.lock.yml (212,294 B) — smoke-test workflows dominate the top of the size range.
• Smallest: notion-issue-summary.lock.yml (81,255 B), example-permissions-warning.lock.yml (81,468 B), codex-github-remote-mcp-test.lock.yml (82,049 B).
• Size spread is ~2.6x between smallest and largest; distribution is fairly tight around the ~137 KB average.

Trigger analysis

Trigger	Count	% of 275
workflow_dispatch	268	97.5%
schedule	186	67.6%
pull_request	37	13.5%
issues	4	1.5%
issue_comment	2	0.7%
workflow_call	2	0.7%
discussion / discussion_comment / push / workflow_run / deployment_status	1 each	0.4%

Top trigger combinations: schedule+workflow_dispatch (183, 66.5%), workflow_dispatch only (48, 17.5%), pull_request+workflow_dispatch (32, 11.6%).

Cron schedules are well-scattered — the most repeated cron strings each appear only twice (e.g. 49 14 * * 1-5, 23 11 * * *), out of 186 scheduled workflows, indicating deliberate time-scattering rather than clustering at round hours.

Safe outputs analysis

Baseline safe-output tools (noop/missing_data/missing_tool/report_incomplete/create_report_incomplete_issue) are present in 269/275 lockfiles (97.8%) — 6 lockfiles have no safe-outputs configured at all.

Safe output type	Count
create_issue	131
create_discussion	91
add_comment	71
create_pull_request	55
push_repo_memory	34
add_labels	29
upload_asset	26
mentions	22
create_pull_request_review_comment	15
submit_pull_request_review	15
update_issue	10

Discussion categories: audits (78), announcements (5), artifacts (2), dev (2), research (2), general (1), daily-news (1). This report itself lands in audits, reinforcing it as the dominant category (89.7% of all discussion-producing workflows use it).

Structural characteristics

Metric	Total	Avg/lockfile	Max
Jobs	2,031	7.4	14
Steps	36,648	133.3	191
Run/script steps	25,179	91.6	127

Lockfiles are heavily expanded from source — nearly 92 inline run-steps per file on average reflects the amount of generated scaffolding (setup, guardrails, safe-output processing, telemetry) per compiled workflow.

Permission patterns

Job-level permission grants (counted per job, not per workflow — 2,031 jobs total):

Read: contents (1,209), actions (657), pull-requests (244), issues (233), discussions (50), security-events (14)

Write: issues (620), contents (387), pull-requests (308), copilot-requests (222), discussions (189), actions (105), checks (26)

Timeout-minutes distribution: 45 min (275 jobs), 10 min (29 jobs), 5 min (2 jobs) — the 45-minute ceiling is the near-universal default for the main agent job.

Tool & MCP patterns

Engine distribution: copilot (167, 60.7%), claude (59, 21.5%), pi (21, 7.6%), codex (15, 5.5%), crush (3), opencode (3), goose (3), aider (1), cursor (1), gemini (1), kiro (1).

MCP server usage: safeoutputs (131), github (92), agenticworkflows (40), mcpscripts (4), and a long tail of single-use integrations (mempalace, graft, agentdb, open-ontologies, ast-grep, ruflo, arxiv, datadog — 1 workflow each).

Interesting findings

1. Engine mix shifted noticeably in one day: claude-engine lockfiles dropped from 65 → 59 (-6), while newer/alternative engines gained ground — crush (0→3), opencode (1→3), goose (1→3), cursor (0→1), kiro (0→1), and antigravity disappeared (1→0). This looks like active engine migration/experimentation rather than noise.
2. workflow_dispatch is nearly universal (97.5%) but schedule is the true "production" signal — the pairing schedule+workflow_dispatch alone accounts for two-thirds of all workflows.
3. Safe-output diversity has a long tail: 45+ distinct safe-output types exist, but 8 of them (create_issue, create_discussion, add_comment, create_pull_request, push_repo_memory, add_labels, upload_asset, mentions) cover the vast majority of non-baseline usage; roughly 20 types appear in only 1 workflow each.
4. MCP integrations are mostly one-off: outside of the 3 dominant servers (safeoutputs, github, agenticworkflows), 8 distinct MCP servers are each used by exactly one workflow, suggesting experimental/bespoke integrations rather than shared infrastructure.
5. copilot-requests write permission jumped +12 (210→222) day-over-day, faster growth than the +2 lockfile-count delta would suggest — worth watching if this trend continues.

Historical trends (vs. 2026-08-04)

Metric	2026-08-04	2026-08-05	Δ
Lockfiles	273	275	+2
Total bytes	37,378,078	37,605,664	+227,586 (+0.6%)
workflow_dispatch	266	268	+2
pull_request trigger	35	37	+2
create_issue	129	131	+2
add_comment	69	71	+2
add_labels	27	29	+2
push_repo_memory	36	34	-2
Jobs / Steps / Scripts (total)	2,025 / 36,513 / 25,055	2,031 / 36,648 / 25,179	+6 / +135 / +124
claude engine	65	59	-6
copilot-requests (write)	210	222	+12
github MCP server	87	92	+5
safeoutputs MCP server	134	131	-3

Growth is broadly proportional to the +2 net new lockfiles, except for the engine-distribution shuffle and the copilot-requests permission bump noted above.

Recommendations

1. Investigate the claude→other-engine migration (-6 claude, several new engine types) to confirm it's intentional and that behavior/cost across the new engines (crush, opencode, goose, cursor, kiro) has been validated.
2. Review the 6 lockfiles with no safe-outputs configured at all — confirm they intentionally have no write-back path.
3. Audit the ~20 safe-output types used by only 1 workflow each for consolidation opportunities or documentation gaps.
4. Monitor the copilot-requests write-permission growth rate against workflow-count growth; a +12 jump against +2 lockfiles is disproportionate and worth a quick check.
5. Consider deduplicating shared MCP/reporting boilerplate to reduce the ~92 average inline run-steps per lockfile, if compile-time supports further extraction.

Methodology note

single-script compact JSON analysis

Generated by 📊 Lockfile Statistics Analysis Agent · agent · 62.7 AIC · ⌖ 35.1 AIC · ⊞ 5.9K · ◷

• expires on Aug 6, 2026, 12:45 PM UTC-08:00