[lockfile-stats] Lockfile Statistics — 2026-08-22

[github-actions[bot]]

Analyzed 289 compiled workflow lockfiles (.github/workflows/*.lock.yml) totaling 42,667,245 bytes (~40.7 MB), avg 147,638 bytes/file. 0 files skipped as malformed. This is the first run recorded in cache-memory history — no prior-day comparison available yet.

Top findings

• workflow_dispatch + schedule is by far the dominant trigger combo (191/289, 66%); 282/289 workflows are manually triggerable via workflow_dispatch.
• Safe-output usage: create_issue (140), create_discussion (91), add_comment (75), create_pull_request (61), add_labels (32) — derived from the actual per-job GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG handler config, not text scanning, so these reflect genuinely enabled outputs per workflow.
• Nearly all workflows (282/289) also carry the standard missing_data/missing_tool/noop/report_incomplete safe-output scaffolding — these are baseline capabilities on most agentic workflows, not indicators of heavy usage.
• Discussion-category usage is concentrated: audits (78 workflows) dominates, followed by announcements (5), with artifacts, dev, research, general, daily-news each in the single digits.
• MCP server adoption: safeoutputs (289, universal), github (119), agenticworkflows (42), serena (25), mcpscripts (12) — a long tail of specialized servers (tavily, sentry, ast-grep, datadog, deepwiki) each used by ≤5 workflows.
• Structurally, workflows average 7.3 jobs, 142 steps, and 61 run: script steps each (max observed: 14 jobs / 202 steps / 83 scripts) — the compiled lockfiles are large primarily due to step count, not per-file bloat outliers (min 88.9 KB, max 238.1 KB, a <3x spread).

File size distribution

Metric	Value
Count	289
Total	42,667,245 bytes
Avg	147,638 bytes
Min	88,893 bytes (example-permissions-warning.lock.yml)
Max	238,082 bytes (smoke-copilot.lock.yml)

Largest 5: smoke-copilot (238.1KB), smoke-copilot-aoai-entra (238.0KB), smoke-copilot-aoai-apikey (235.4KB), deep-report (201.4KB), smoke-claude (197.4KB) — the largest files are Copilot-engine smoke tests, likely due to bundled engine-specific tool schemas.

Trigger analysis

Trigger	Workflows
workflow_dispatch	282
schedule	194
pull_request	42
issues	5
issue_comment	3
workflow_call	2
discussion / discussion_comment / push / pull_request_review_comment / deployment_status / workflow_run	1 each

Top combinations: schedule+workflow_dispatch (191), workflow_dispatch only (48), pull_request+workflow_dispatch (37).

Most frequent cron times cluster in early UTC morning hours (e.g. 7 5 * * * x3, several x2 entries between 03:00–11:00 UTC) — consistent with staggered daily-batch scheduling to avoid a thundering herd at the top of the hour.

Safe outputs analysis

Output type	Workflows
create_issue	140
create_discussion	91
add_comment	75
create_pull_request	61
add_labels	32

Discussion categories (from create_discussion config): audits (78), announcements (5), artifacts (2), dev (2), research (2), general (1), daily-news (1).

Methodology note: the first analyzer pass used raw regex text-scanning, which incorrectly returned ~100% saturation for create_issue/create_discussion/create_pull_request because tool-schema boilerplate for the safeoutputs MCP server is embedded in every lockfile regardless of which outputs are actually configured. The analyzer was corrected mid-run to parse the per-job GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG env JSON instead, which reflects true per-workflow configuration. The figures above use the corrected method.

Structural characteristics

Metric	Avg	Min	Max
Jobs/workflow	7.32	4	14
Steps/workflow	142.13	85	202
Script (run:) steps/workflow	61.04	39	83

Timeout-minutes distribution across jobs: 10 (306 jobs), 45 (290), 60 (283), 90 (3), 5 (2), 120 (2), 180 (1) — the three dominant tiers (10/45/60) likely correspond to standard job roles (detection/activation, agent execution, safe-output handling).

Permission patterns & engine distribution

No top-level permissions: block or uses:-based engine markers were reliably detected via this run's structural heuristics — compiled lockfiles appear to express permissions and engine selection through mechanisms (e.g. per-job env/config or generated step logic) not captured by the current parser. Flagged as a follow-up for the next script iteration rather than reported as "zero permissions" or "no engine in use," which would be misleading.

Tool & MCP patterns

MCP server	Workflows
safeoutputs	289
github	119
agenticworkflows	42
serena	25
mcpscripts	12
tavily	5
sentry	3
ast-grep	2
datadog	2
deepwiki	2

All server/tool counts were derived from the # gh-aw-manifest: JSON comment (no regex fallback needed — 0 workflows required it), so these counts reflect the compiled manifest directly rather than text pattern matching.

Recommendations

1. Fix engine/permission detection in the next analyzer version — current structural heuristics returned empty for both; a follow-up pass should trace how the compiler emits engine selection and permissions in these lockfiles (likely per-job env or generated logic) so future runs can report accurate distributions.
2. Standardize cron stagger — since most scheduled workflows already avoid :00, consider documenting the convention so new workflows follow it by default.
3. Review the 5 largest lockfiles (all Copilot-engine or deep-report workflows, 197–238 KB) for opportunities to trim embedded tool schemas if compile size becomes a concern.
4. Re-run this analysis on a regular cadence (cache-memory history is now seeded with today's summary) to start tracking trend deltas.

Methodology: single-script compact JSON analysis (PyYAML safe_load over all .lock.yml files, per-job GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG parsing for safe-output accuracy, # gh-aw-manifest: JSON for MCP server/tool usage). Script cached at /tmp/gh-aw/cache-memory/scripts/lockfile_stats_v2.py; summary at /tmp/gh-aw/cache-memory/history/2026-08-22.json.

References:

• §32596143251

Generated by 📊 Lockfile Statistics Analysis Agent · agent · 56.6 AIC · ⌖ 8.18 AIC · ⊞ 6.8K · ◷

• expires on Aug 23, 2026, 12:22 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Lockfile Statistics Analysis Agent.

A newer discussion is available at Discussion #55163.