[lockfile-stats] Lockfile Statistics Audit — 2026-08-07 (282 workflows)

[github-actions[bot]]

Executive summary

• 282 lockfiles analyzed (.github/workflows/*.lock.yml), 0 skipped
• Total size: 36.8 MB (38,624,882 bytes) — avg 136.9 KB, min 81.8 KB, max 215.7 KB
• Analysis date: 2026-08-07 · Methodology: single-script compact JSON analysis

File size distribution

Metric	Value
Count	282
Avg	136,968 bytes
Min	81,764 bytes (notion-issue-summary.lock.yml)
Max	215,744 bytes (smoke-copilot-aoai-entra.lock.yml)

Largest 5: smoke-copilot-aoai-entra (215.7K), smoke-copilot (214.8K), smoke-copilot-aoai-apikey (213.2K), deep-report (186.8K), smoke-claude (183.1K) — dominated by smoke-test workflows with heavy inline engine/MCP scaffolding.

Smallest 5: notion-issue-summary (81.8K), example-permissions-warning (82.0K), codex-github-remote-mcp-test (82.0K), firewall (82.9K), hippo-embed (88.1K).

Trigger analysis

Trigger	Workflows
workflow_dispatch	275 (97.5%)
schedule	193 (68.4%)
pull_request	37
issues	4
issue_comment	2
workflow_call	2
deployment_status / workflow_run / discussion / discussion_comment / push	1 each

Top combinations: schedule + workflow_dispatch (190), workflow_dispatch only (48), pull_request + workflow_dispatch (32). Manual dispatch is near-universal, almost always paired with a schedule.

Cron frequency: 106 distinct cron expressions, mostly unique per-workflow (daily cadence staggered by minute/hour to spread load); a handful repeat 2–3× (e.g. 7 5 * * * ×3). A few run more often than daily (*/6, */4 hour patterns).

Safe outputs analysis

Extracted from each workflow's GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG (the compiled handler config), not text mentions — this avoids false positives from embedded documentation.

Output type	Count	% of lockfiles
noop / missing-data / missing-tool / report-incomplete / create-report-incomplete-issue	276	98% (default safety-net set)
create-issue	135	48%
create-discussion	91	32%
add-comment	71	25%
create-pull-request	58	21%
add-labels	29	10%
upload-asset	26	9%
mentions	22	8%
create-pull-request-review-comment	15	5%
submit-pull-request-review	15	5%
upload-artifact	14	5%
create-check-run	13	5%
push-to-pull-request-branch	11	4%
update-issue	10	4%
(28 more types, ≤7 each)	—	—

Discussion categories (from create_discussion.category): audits 78, announcements 5, artifacts 2, dev 2, research 2, general 1, daily-news 1 — sums exactly to the 91 create-discussion workflows, confirming extraction consistency. audits (this category) accounts for 86% of discussion-producing workflows.

Structural characteristics

Metric	Total	Avg/workflow	Max
Jobs	2,071	7.34	14
Steps	37,742	133.84	192
Script/run steps	26,036	92.33	128

Permission patterns

Aggregated across all job-level permissions: blocks (282 workflows × multiple jobs each):

Scope	Read	Write
contents	1,235	393
actions	674	107
pull-requests	250	314
issues	239	634
discussions	49	189
security-events	14	9
copilot-requests	—	222
checks	1	26
packages	2	1
id-token	—	4
others (models, vulnerability-alerts, deployments, attestations, statuses)	≤1 each	≤1 each

issues:write (634) and contents:read (1,235) are the most common permission grants — expected given the create-issue/create-discussion output mix and near-universal repo-content reads for context gathering.

Tool & MCP patterns

Timeout distribution (job-level timeout-minutes): 45 min dominates (283 job declarations), 10 min (29), 5 min (2) — the 45-minute ceiling is effectively the house default.

Engine distribution (approximate — derived from engine identifiers found per file, may include minor double-counts where an engine is referenced in multiple env blocks): copilot 167, claude 59, codex 32, pi 22, crush/aider/cursor/kiro/opencode/goose 3 each, gemini 1. Copilot is the dominant engine (~59% of workflows).

MCP tooling: the github MCP server is configured in 97 workflows; safeoutputs (133) and agenticworkflows (40) are the other common custom servers. GitHub MCP tool surface is broad — actions_get/actions_list/get_code_scanning_alert/get_commit appear most (up to 112 workflow configs), with ~40 other github__* read tools each appearing in 58-59 configs. A long tail of specialty servers appears in just 1 workflow each: mempalace, graft, agentdb, open-ontologies, ast-grep, ruflo, arxiv, datadog, plus playwright, grafana, deepwiki tool families at very low counts (1-3). Note: this reflects configured tool availability, not runtime call counts.

Interesting findings

1. Universal safety net: 276/282 workflows (98%) ship the same five fallback safe-output handlers (noop, missing-data, missing-tool, report-incomplete, create-report-incomplete-issue) — this is baked into the compiler's default output set, not something authors opt into individually.
2. audits is the dominant discussion category (78 of 91, 86%) — this workflow itself publishes there, confirming the category is a de facto standard for periodic reporting agents.
3. workflow_dispatch is nearly ubiquitous (97.5%) even on scheduled workflows — manual re-run capability is treated as a required safety valve, not an occasional add-on.
4. Permission asymmetry: issues skews heavily toward write (634 write vs 239 read) while contents skews heavily toward read (1,235 read vs 393 write) — consistent with an issue/discussion-reporting fleet that reads repo state but rarely writes source.
5. Copilot is now the majority engine (167/282, 59%), well ahead of Claude (59) and Codex (32), suggesting most of this workflow fleet has migrated off Claude-only defaults.

Historical trends

No prior history found — this is the first recorded baseline (2026-08-07). Future runs will compare against this snapshot.

Recommendations

• Consider consolidating the largest smoke-test lockfiles (200K+ bytes) if they're not exercising meaningfully different code paths — they account for a disproportionate share of total repo size.
• The heavy skew toward the audits discussion category suggests room for sub-categorization (e.g. by domain) if discussion volume grows.
• Given 59% Copilot adoption, verify MCP/tool parity across engines so workflows aren't accidentally engine-locked by tool availability.

---

Methodology: single-script compact JSON analysis — one Python analyzer (lockfile_stats_v1.py, cached at /tmp/gh-aw/cache-memory/scripts/) parsed all lockfiles via yaml.safe_load, extracting safe-output types from each workflow's GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG and permissions from job-level permissions: blocks (not text/regex heuristics) for the metrics that support it. Engine and MCP-server-name detection remain regex-based and are noted as approximate above.

Generated by 📊 Lockfile Statistics Analysis Agent · agent · 73.5 AIC · ⌖ 31.2 AIC · ⊞ 5.9K · ◷

• expires on Aug 8, 2026, 12:30 PM UTC-08:00