[lockfile-stats] Lockfile Statistics Report — 2026-08-08

[github-actions[bot]]

Overview

Analyzed 284 lockfiles (.github/workflows/*.lock.yml) on 2026-08-08. Total size 39,229,740 bytes (~37.4 MB), avg 138,132.9 bytes/file. 0 files skipped. This is the first run — no prior history in cache-memory, so today's summary becomes the baseline (history/2026-08-08.json).

File size distribution

Metric	Value
Count	284
Total	39,229,740 bytes
Avg	138,132.9 bytes
Max	smoke-copilot-aoai-entra.lock.yml — 219,927 bytes
Min	notion-issue-summary.lock.yml — 81,768 bytes

Trigger analysis

Trigger	Count	% of 284
workflow_dispatch	277	97.5%
schedule	193	67.9%
pull_request	39	13.7%
issues	4	1.4%
issue_comment	2	0.7%
workflow_call	2	0.7%
discussion / discussion_comment / push / workflow_run / deployment_status	1 each	0.4%

Top combinations: schedule + workflow_dispatch (190), workflow_dispatch only (48), pull_request + workflow_dispatch (34).

Cron schedules are heavily staggered — no single time slot is shared by more than 3 workflows (e.g. 7 5 * * * ×3), out of 193 scheduled workflows across ~100 distinct times, including several */6, */4, and */12 hourly-interval jobs.

Safe outputs analysis

Type	Count
create-discussion	284*
create-issue	284*
create-pull-request	284*
add-comment	88
create-pull-request-review-comment	17
update-issue	10

*The three types marked * matched in all 284 files under text-substring detection — this almost certainly reflects shared safe-outputs boilerplate/config text present in every lockfile rather than 100% real per-workflow usage. Treat add-comment, create-pull-request-review-comment, and update-issue (which show real variance) as the more trustworthy signal from this pass; see Recommendations.

Structural characteristics

Metric	Value
Avg jobs/workflow	7.33
Max jobs	release.lock.yml — 14
Avg steps/workflow	135.69
Max steps	smoke-copilot.lock.yml — 194
Max scripts	smoke-copilot-aoai-entra.lock.yml — 129

Permission patterns

Read (top): contents 1243, actions 678, pull-requests 252, issues 240, discussions 49, security-events 14
Write (top): issues 640, contents 393, pull-requests 320, copilot-requests 224, discussions 189, actions 107, checks 28

Read permissions skew toward contents/actions (repo + CI introspection); write permissions skew toward issues/contents — consistent with an agent fleet that reads broadly but writes narrowly (issues, PRs, discussions).

Timeout distribution

Timeout (min)	Job count
45	285
10	29
5	2

Only ~316 of an estimated ~2,082 total jobs (7.33 avg × 284) declare an explicit timeout-minutes — the rest inherit workflow/runner defaults.

Tool & MCP patterns

Engine distribution (via agent_id in embedded metadata, one per lockfile):

Engine	Count	%
copilot	168	59.2%
claude	59	20.8%
pi	22	7.7%
codex	15	5.3%
crush / aider / cursor / kiro / opencode / goose	3 each	1.1% each
gemini	1	0.4%
pydantic-ai	1	0.4%

MCP server container images referenced (raw reference counts, not unique-per-lockfile): gh-aw-mcpg 1627, github-mcp-server 1228, serena-mcp-server 127.

Findings

1. Manual triggering is near-universal: 97.5% of lockfiles (277/284) support workflow_dispatch, indicating an operations-friendly design where nearly every automation can be run on demand.
2. Copilot is the dominant engine (59.2%), with Claude second (20.8%) and Codex a distant fourth (5.3%) behind an internal pi engine (7.7%) — six other engines (crush, aider, cursor, kiro, opencode, goose, gemini, pydantic-ai) each account for ≤1.1%, suggesting experimental/single-purpose adoption.
3. Scheduled workflows are deliberately staggered: across 193 scheduled workflows and ~100 distinct cron expressions, no time slot is shared by more than 3 workflows — load-spike avoidance appears intentional rather than incidental.
4. Complexity is multi-dimensional, not correlated: the largest file by bytes and by script count (smoke-copilot-aoai-entra.lock.yml) is not the same file as the one with the most jobs (release.lock.yml, 14) or the most steps (smoke-copilot.lock.yml, 194) — size, job count, and step count each spotlight a different workflow.
5. Explicit timeouts are the exception, not the rule: only ~15% of an estimated ~2,082 total jobs declare timeout-minutes, with 45 minutes as the overwhelming default among those that do.

Historical trends

No prior summary found in /tmp/gh-aw/cache-memory/history/ — this run establishes the baseline (history/2026-08-08.json) for future delta comparisons.

Recommendations

• Refine safe-output-type detection in a v2 analyzer to parse structured config rather than text-substring matching — the current pass over-counts create-discussion/create-issue/create-pull-request at 284/284 each, which is very unlikely to be genuine 100% usage.
• Review whether the ~85% of jobs without an explicit timeout-minutes are relying on a sane platform default, especially for high-step workflows like smoke-copilot.lock.yml (194 steps).
• Consider whether the six single/low-adoption engines (≤3 lockfiles each) are still needed or can be consolidated to reduce engine-support surface area.

Methodology

Single-script compact JSON analysis (lockfile_stats_v1.py, PyYAML safe_load, one execution pass over all lockfiles). yaml_available: true; 0 files skipped.

Generated by 📊 Lockfile Statistics Analysis Agent · agent · 49.7 AIC · ⌖ 30.9 AIC · ⊞ 5.9K · ◷

• expires on Aug 9, 2026, 12:21 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Lockfile Statistics Analysis Agent.

A newer discussion is available at Discussion #51638.