[lockfile-stats] Lockfile Statistics Report — 2026-08-19

[github-actions[bot]]

Executive Summary

• Lockfiles analyzed: 286 (0 skipped, 0 malformed)
• Total size: 40,831,227 bytes (~38.9 MB) — avg 142,766 bytes, min 84,695, max 224,522
• Date: 2026-08-19 · Parser: PyYAML safe_load (yaml_available: true)

File Size Distribution

Metric	Value
Average	142,766 bytes
Minimum	84,695 (example-permissions-warning.lock.yml)
Maximum	224,522 (smoke-copilot.lock.yml)

Top 5 largest: smoke-copilot (224,522) · smoke-copilot-aoai-entra (224,395) · smoke-copilot-aoai-apikey (221,801) · pr-sous-chef (209,906) · deep-report (194,948)

Top 5 smallest: example-permissions-warning (84,695) · codex-github-remote-mcp-test (84,908) · notion-issue-summary (85,492) · firewall (85,595) · hippo-embed (91,497)

Trigger Analysis

Trigger	Count	% of 286
workflow_dispatch	279	97.6%
schedule	192	67.1%
pull_request	41	14.3%
issues	5	1.7%
issue_comment	3	1.0%
workflow_call	2	0.7%

Top combinations: schedule + workflow_dispatch — 189 (66.1%) · workflow_dispatch only — 48 (16.8%) · pull_request + workflow_dispatch — 36 (12.6%)

Cron cadence (of 192 scheduled): daily 123 · weekly 62 · monthly/yearly 4 · hourly 3

Safe Outputs Analysis

Safe output type	Count
create_issue	138
create_discussion	91
add_comment	75
create_pull_request	60
add_labels	31
upload_asset	26
create_pull_request_review_comment	16
submit_pull_request_review	16
create_check_run	14
update_issue	11

Discussion categories: audits 78 · announcements 5 · artifacts 2 · dev 2 · research 2 · general 1 · daily-news 1

Structural Characteristics

	Avg	Min	Max
Jobs/workflow	7.33	4	14
Steps/workflow	139.84	82	200
Scripts/workflow	96.0	59	132

Most jobs: release.lock.yml (14) · daily-model-inventory (12) · smoke-copilot-aoai-apikey (12) · smoke-copilot-aoai-entra (12) · smoke-copilot (12)

Permission Patterns

Read (top)	Count	Write (top)	Count
contents	1,252	issues	646
actions	681	contents	395
pull-requests	255	pull-requests	329
issues	243	copilot-requests	236
discussions	50	discussions	189

Timeouts: avg 41.56 min (min 5, max 45) across 318 job blocks with an explicit timeout.

Tool & MCP Patterns

Engine distribution: copilot 172 (60.1%) · claude 60 (21.0%) · pi 22 (7.7%) · codex 15 (5.2%) · crush/aider/opencode/goose 3 each · cursor/deepseek-harness/gemini/kiro/pydantic-ai 1 each

MCP servers: github 60 · safeoutputs 60 · agenticworkflows 16 · serena 6 · playwright 3 · mcpscripts 3 · tavily 2 · agentdb/ast-grep/grafana/sentry/ruflo/deepwiki/microsoftdocs 1 each

Historical Trend (vs. 2026-08-18)

Metric	2026-08-18	2026-08-19	Δ
Lockfile count	286	286	0
Total bytes	40,797,354	40,831,227	+33,873 (+0.08%)
Avg size	142,648.1	142,766.5	+118.4
Max size	225,511	224,522	−989

Trigger counts, safe-output type counts, discussion categories, permission read/write distributions, engine distribution, and MCP usage were unchanged day-over-day. The size delta is driven entirely by individual workflow content churn, not additions/removals.

Interesting Findings

1. Corpus size held steady but content churned: file count is unchanged (286) yet total bytes grew +33.9 KB. The three Copilot AOAI smoke variants (aoai-entra, aoai-apikey) each shrank ~1.0–1.1 KB, while pr-sous-chef.lock.yml jumped into the top-5 largest (209,906 bytes), displacing cloclo.lock.yml from yesterday's top 10 — net effect is a size increase from broad small changes elsewhere in the corpus.
2. Copilot dominates engine share: 172/286 workflows (60%) compile to the Copilot engine vs. 60 (21%) for Claude — despite the repo being the gh-aw (GitHub Agentic Workflows) reference implementation, most production lockfiles target Copilot.
3. Unattended-by-default design: 97.6% of workflows support workflow_dispatch and 67% run on schedule; the single dominant trigger combination (schedule + workflow_dispatch, 66% of all workflows) indicates the corpus is built around scheduled automation with a manual override, not event-driven reaction.
4. Issue-write permission outpaces issue-write usage: 646 job-permission blocks grant issues: write, far more than the 138 workflows that actually call create_issue as a safe output — a ~4.7x gap suggesting broader-than-needed permission grants (add_labels, add_comment, update_issue, close_issue also consume issue-write, but the gap is still notable).
5. Discussions safe output is disproportionately audit-focused: of 91 workflows using create_discussion, 78 (86%) publish specifically to the "audits" category — this workflow itself is one of them.

Recommendations

• Investigate the byte-level drift in the Copilot AOAI smoke workflows (aoai-entra, aoai-apikey) to confirm it reflects an intentional prompt/config change rather than nondeterministic lock-file generation.
• Audit the issues: write permission footprint (646 grants across 286 workflows) against actual safe-output usage to identify workflows that can be scoped down.
• Track pr-sous-chef.lock.yml's growth into the top-5 largest lockfiles — large job/step/script counts in a single workflow can affect compile and runtime overhead.
• Since Claude/Codex/other engines represent a shrinking minority (40% combined) relative to Copilot, ensure smoke-test and CI coverage remains balanced across engines rather than skewing toward the majority engine.

Methodology

single-script compact JSON analysis

Generated by 📊 Lockfile Statistics Analysis Agent · agent · 38.9 AIC · ⌖ 4.85 AIC · ⊞ 6.2K · ◷

• expires on Aug 20, 2026, 12:22 PM UTC-08:00