[lockfile-stats] Lockfile Statistics Analysis — 2026-08-09

[github-actions[bot]]

Analysis of all .github/workflows/*.lock.yml files compiled in this repository as of 2026-08-09. All 284 lockfiles parsed successfully (0 skipped, PyYAML available).

Executive Summary

Metric	Value
Lockfiles analyzed	284 (0 skipped)
Total size	39,335,264 bytes (~37.5 MB)
Average file size	138,505 bytes (~135 KB)
Total jobs / avg per file	~2,082 / 7.33
Total steps / avg per file	~38,516 / 135.62

File Size Distribution

Stat	File	Bytes
Smallest	notion-issue-summary.lock.yml	82,134
Largest	smoke-copilot-aoai-entra.lock.yml	220,359
Average	—	138,505

Trigger Analysis

Trigger	Files	%
workflow_dispatch	277	97.5%
schedule	193	68.0%
pull_request	39	13.7%
issues	4	1.4%
issue_comment	2	0.7%
workflow_call	2	0.7%
discussion, discussion_comment, push, workflow_run, deployment_status	1 each	0.4%

Top trigger combinations: schedule+workflow_dispatch (190, 66.9%), workflow_dispatch only (48, 16.9%), pull_request+workflow_dispatch (34, 12.0%).

Full trigger combination and cron-frequency breakdown

Cron schedules are highly diverse — 193 scheduled workflows use ~100 distinct cron expressions, mostly scattered across the day/week to spread load; only 7 5 * * * repeats as often as 3 times, ten expressions repeat twice, the rest are unique.

Safe Outputs Analysis

Safe output type	Files	% of 284
create-issue	131	46.1%
create-discussion	88	31.0%
add-comment	67	23.6%
create-pull-request	58	20.4%
create-pull-request-review-comment	13	4.6%
update-issue	9	3.2%

Baseline toolkit (missing-tool, missing-data, noop, report-incomplete, create-report-incomplete-issue) appears in 273/284 files (96.1%) — effectively a standard bundle across the fleet.

Discussion categories (of the 88 workflows creating discussions): audits dominates with 78 (88.6%); artifacts, dev, announcements, research each appear twice; general and daily-news once each.

Long tail of less-common safe outputs

push-repo-memory (32), upload-asset (26), add-labels (25), mentions (22), submit-pull-request-review (13), create-check-run (11), push-to-pull-request-branch (11), upload-artifact (11), max-bot-mentions (8), close-issue (5), assign-to-agent (5), comment-memory (5), update-pull-request (4), close-pull-request (4), link-sub-issue (4), create-code-scanning-alert (3), close-discussion (3), remaining types (create-agent-session, resolve-pull-request-review-thread, remove-labels, dismiss-pull-request-review, call-workflow, update-release, add-reviewer, post-slack-message, post-to-slack-channel, send-slack-message, dispatch-workflow, assign-to-user, test-environment, create-project-status-update, update-project) appear 1-2 times each.

Structural Characteristics

Metric	Value	File
Avg jobs/file	7.33	—
Max jobs	14	release.lock.yml
Avg steps/file	135.62	—
Max steps	194	smoke-copilot.lock.yml
Max script-like steps	129	smoke-copilot-aoai-entra.lock.yml

Permission Patterns

Aggregated across all job-level permissions: blocks (a workflow's jobs may each grant scopes independently, so counts reflect job-grants, not distinct workflows):

Read scope	Grants		Write scope	Grants
contents	1,243		issues	640
actions	678		contents	392
pull-requests	252		pull-requests	320
issues	240		copilot-requests	224
discussions	49		discussions	189
security-events	14		actions	107

Timeout budgeting is highly standardized: 285 job instances use a 45-minute timeout, 29 use 10 minutes, and only 2 use 5 minutes — the 45-minute budget is effectively the fleet-wide default for primary agent jobs.

Tool & MCP Patterns

Engine distribution (284 workflows, one engine each):

Engine	Workflows	%
copilot	168	59.2%
claude	59	20.8%
pi	22	7.7%
codex	15	5.3%
crush, aider, cursor, kiro, opencode, goose	3 each (18 total)	6.3%
gemini, pydantic-ai	1 each	0.7%

MCP server mentions (raw text occurrence counts, not distinct-workflow adoption): gh-aw-mcpg gateway (1,627), github-mcp-server (1,228), serena-mcp-server (127, niche use). Per-tool call frequencies were not captured by this analyzer version — see Recommendations.

Interesting Findings

1. Copilot is now the majority engine (59.2% of workflows) vs. Claude (20.8%) — a clear shift toward Copilot-driven agentic workflows in this repo, with eight other engines splitting the remaining ~20%.
2. Manual re-run is nearly universal, scheduling is the primary driver: 97.5% of workflows support workflow_dispatch, and two-thirds (66.9%) pair it with schedule — the dominant pattern is "scheduled but manually re-runnable," not push/PR-triggered.
3. Reporting skews toward issues over discussions: 46.1% of workflows report via create-issue vs. 31.0% via create-discussion, even though the baseline safe-outputs bundle (missing-tool/missing-data/noop/report-incomplete) is present in 96.1% of files — most workflows are equipped to report gaps but differ in their primary output channel.
4. Discussion reporting is almost entirely audit-focused: 78 of 88 discussion-creating workflows (88.6%) target the audits category specifically.
5. Timeout policy is remarkably uniform: only 31 of ~2,082 total job instances deviate from the 45-minute default, concentrated in short setup/build jobs (10 or 5 minutes).
6. Two smoke-test workflows are notable outliers in complexity: smoke-copilot-aoai-entra.lock.yml is both the largest file (220 KB) and has the most script-like steps (129), while smoke-copilot.lock.yml has the most total steps (194) — both well above the ~135-step fleet average.

Historical Trends

Compared to the prior snapshot (2026-08-08):

Metric	2026-08-08	2026-08-09	Δ
Lockfile count	284	284	0
Total bytes	39,229,740	39,335,264	+105,524 (+0.27%)
workflow_dispatch count	277	277	0

No structural change day-over-day; the byte delta reflects minor recompilation drift (e.g., pinned action SHA/version bumps) rather than new workflows or triggers.

Recommendations

• Given Copilot now covers 59% of workflows vs. 21% for Claude, prioritize Copilot-engine tooling, docs, and troubleshooting guides to match actual fleet composition.
• Only 31% of workflows create discussions (vs. 46% creating issues) for similar "report findings" use cases — consider a guideline for choosing between create-discussion and create-issue to reduce inconsistent reporting patterns across similar workflow types.
• For the ~11% of discussion-creating workflows not using the audits category, confirm the divergence is intentional rather than a copy-paste gap from the audits template.
• The analyzer currently reports MCP server mentions but not per-tool call frequencies (mcp_tools was empty this run) — a future script version (bump to lockfile_stats_v2.py) should extract tool-level usage from the generated safe-outputs/tools configuration for deeper MCP insight.

Methodology

Single-script compact JSON analysis: one cached Python analyzer (lockfile_stats_v1.py, persisted at /tmp/gh-aw/cache-memory/scripts/) parsed all 284 .github/workflows/*.lock.yml files with yaml.safe_load plus targeted regex extraction (for embedded safe-outputs config JSON and engine metadata), producing one compact JSON summary consumed for this report. A schema-preserving bug fix was applied in-place this run: the prior version's safe-output-type detection used naive substring search across the whole file text, which falsely reported 100% adoption for several output types; it now parses the actual embedded safeoutputs/config.json heredoc per file for accurate per-workflow type counts.

References:

• §31333834644

Generated by 📊 Lockfile Statistics Analysis Agent · agent · 116.4 AIC · ⌖ 32.1 AIC · ⊞ 5.8K · ◷

• expires on Aug 10, 2026, 12:27 PM UTC-08:00

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-08-10T20:27:19.717Z.

Closed by Workflow