[lockfile-stats] Lockfile Statistics Analysis — 2026-08-18

[github-actions[bot]]

Lockfile Statistics — 2026-08-18

Analysis of all 286 .github/workflows/*.lock.yml files (0 skipped, 0 malformed). Total on-disk size: 38.9 MB (40,797,354 bytes), avg 142.6 KB/file (min 82.7 KB, max 220.2 KB). First run for this analysis — no prior history to compare trends against.

File size distribution

Metric	Value
Count	286
Total	38.9 MB
Avg	142.6 KB
Min	82.7 KB (example-permissions-warning.lock.yml)
Max	220.2 KB (smoke-copilot-aoai-entra.lock.yml)

Top 5 largest / smallest

Largest: smoke-copilot-aoai-entra (220.2K), smoke-copilot (219.3K), smoke-copilot-aoai-apikey (217.7K), deep-report (190.4K), smoke-claude (187.0K)

Smallest: example-permissions-warning (82.7K), codex-github-remote-mcp-test (82.9K), notion-issue-summary (83.5K), firewall (83.6K), hippo-embed (89.4K)

Trigger analysis

• workflow_dispatch: 279/286 workflows (97.6%) — near-universal manual trigger support
• schedule: 192/286 (67.1%)
• pull_request: 41, issues: 5, issue_comment: 3, workflow_call: 2, others (push, workflow_run, discussion, discussion_comment, pull_request_review_comment, deployment_status): 1 each

Dominant combination: schedule + workflow_dispatch — 189 workflows (66%), the classic scheduled-agent pattern. workflow_dispatch alone: 48. pull_request + workflow_dispatch: 36.

Cron cadence (192 scheduled workflows): daily 123 (64%), weekly 62 (32%), monthly/yearly 4, hourly 3.

Safe outputs analysis

Type	Count	Type	Count
create_issue	138	update_issue	11
create_discussion	91	remove_labels	7
add_comment	75	close_issue	6
create_pull_request	60	update_pull_request	5
add_labels	31	assign_to_agent	5
upload_asset	26	link_sub_issue	4
create_pull_request_review_comment	16	close_pull_request	4
submit_pull_request_review	16	close_discussion	3
create_check_run	14	(10 other types)	≤3 each

Discussion categories (91 create_discussion workflows): audits 78 (86%), announcements 5, artifacts 2, dev 2, research 2, general 1, daily-news 1.

Structural characteristics

Metric	Avg	Min	Max
Jobs/workflow	7.33	4	14 (release.lock.yml)
Steps/workflow	139.84	82	200
Inline scripts/workflow	96.0	59	132

Job-level timeout-minutes set on 318 jobs, avg 41.6 min (range 5–45).

Permission patterns

Top job-level grants — read: contents 1252, actions 681, pull-requests 255, issues 243, discussions 50. write: issues 646, contents 395, pull-requests 329, copilot-requests 236, discussions 189.

Tool & MCP patterns

Engine distribution: copilot 172 (60%), claude 60 (21%), pi 22, codex 15, crush/aider/opencode/goose 3 each, cursor/deepseek-harness/gemini/kiro/pydantic-ai 1 each.

MCP servers referenced (see caveat below): github 60, safeoutputs 60, agenticworkflows 16, serena 6, playwright 3, mcpscripts 3, tavily 2, agentdb/ast-grep/grafana/sentry/ruflo/deepwiki/microsoftdocs 1 each.

Methodology caveat: MCP tool lists are extracted from # - mcp__... comment blocks in the compiled lockfile. This annotation style is only observed on claude-engine workflows (counts top out at exactly 60, matching the claude engine total) — the ~226 copilot/other-engine workflows' MCP usage is not captured by this method and is likely undercounted.

Interesting findings

1. workflow_dispatch is nearly universal (97.6%) and schedule+workflow_dispatch is the dominant pattern (66%) — this repo's agentic workflows are overwhelmingly built as manually-triggerable scheduled agents, not event-reactive bots.
2. Copilot is the majority engine (60%), more than double Claude (21%) and outnumbering all 11 other engines combined (19%).
3. create_issue outranks create_discussion as the most common safe output (138 vs 91) despite this very report being a discussion — issue-based reporting is the more common pattern repo-wide.
4. "audits" dominates discussion categories (86% of all create_discussion workflows), confirming a strong repo convention of daily audit/report-style discussions (this workflow included).
5. MCP visibility is engine-skewed: the comment-based tool-list extraction only surfaces Claude-engine MCP usage, meaning true cross-engine MCP tool adoption is likely significantly higher than the raw numbers show.

Historical trends

No prior snapshots found in /tmp/gh-aw/cache-memory/history/ — this is the first recorded baseline. Future runs will compare against 2026-08-18.json.

Recommendations

• Track MCP tool/server usage per-engine in the compiler output (not just via Claude-specific comments) to get accurate cross-engine adoption stats.
• Spot-check the 189 job-level discussions: write grants against the 91 workflows that actually call create_discussion — some may be broader than needed.
• Consider whether the 7 workflows without workflow_dispatch should gain it for manual debugging/testing parity with the rest of the fleet.
• Revisit the handful of workflows at the top end of steps/scripts (~200 steps, ~130 scripts) — mostly copilot smoke-tests — if CI feedback latency becomes a concern.

Methodology: single-script compact JSON analysis (lockfile_stats_v1.py, cached at /tmp/gh-aw/cache-memory/scripts/), parsed via PyYAML safe_load with regex extraction for embedded safe-output/engine/MCP metadata. 0 files skipped.

Generated by 📊 Lockfile Statistics Analysis Agent · agent · 86.4 AIC · ⌖ 4.8 AIC · ⊞ 6.2K · ◷

• expires on Aug 19, 2026, 12:23 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Lockfile Statistics Analysis Agent.

A newer discussion is available at Discussion #54077.