[lockfile-stats] Lockfile Statistics Analysis — 2026-08-24

[github-actions[bot]]

Lockfile statistics — 2026-08-24

Analysis of all .github/workflows/*.lock.yml compiled workflow lockfiles in this repo. Run: §32772936336.

Snapshot: 292 lockfiles, 43.4 MB total, avg 148.7 KB/file (range 88.8 KB – 236.7 KB). 0 skipped/malformed. 0 unresolved discussion categories, 0 unresolved engines/permissions.

File size distribution

Metric	Value
Count	292
Total bytes	43,418,004 (~41.4 MB)
Avg size	148,692 bytes
Min size	88,845 bytes
Max size	236,698 bytes

Trigger analysis

Top triggers: workflow_dispatch (285), schedule (197), pull_request (42), issues (5), issue_comment (3), workflow_call (2). Long tail of single-use triggers (deployment_status, workflow_run, discussion, discussion_comment, push, pull_request_review_comment).

Top combinations: schedule+workflow_dispatch (194), workflow_dispatch alone (48), pull_request+workflow_dispatch (37).

workflow_dispatch is present in 285/292 (97.6%) of workflows — near-universal manual-trigger support.

Cron cadence detail

30 distinct cron expressions observed; most common: 7 5 * * * (3), then a cluster of daily crons at 2/2 occurrences each (49 14 * * 1-5, 23 11 * * *, 38 3 * * *, 9 3 * * *, 41 4 * * *, 26 5 * * *, 37 5 * * *, 40 3 * * *). The rest are unique single-workflow schedules — cron times are well-spread across the day, avoiding a thundering-herd pattern.

Safe outputs analysis

Safe output type	Count
create_issue	142
create_discussion	92
add_comment	76
create_pull_request	62
push_repo_memory	34
add_labels	32
upload_asset	26
mentions	23
create_pull_request_review_comment / submit_pull_request_review	16 each
upload_artifact / create_check_run	14 each
update_issue / push_to_pull_request_branch	11 each

(missing_data, missing_tool, noop, report_incomplete appear on 286 workflows — these are safe-output runtime primitives available to nearly every workflow, not opt-in output types.)

Discussion categories (92 create_discussion workflows, 92/92 resolved — 0 unresolved):

Category	Count
audits	79
announcements	5
artifacts	2
dev	2
research	2
general	1
daily-news	1

audits dominates at 86% of discussion-producing workflows — consistent with this workflow's own category.

Structural characteristics

Metric	Avg	Max
Jobs/workflow	7.34	14
Steps/workflow	143.1	202
Script steps/workflow	98.28	133

Timeout distribution (minutes): 10→310, 45→293, 60→286, 90→3, 5→2, 120→2, 180→1 (counts are per-job, so exceed 292; most jobs use the 10/45/60-minute tiers).

Permission patterns

From jobs.agent.permissions (the scope that mirrors workflow frontmatter):

Scope	read	write	none
contents	292	0	0
pull-requests	252	0	40
issues	246	0	46
discussions	52	0	240
actions	110	0	182
security-events	14	0	278

The agent job itself is never granted direct write on any scope — all mutation happens through safe-output jobs. Taking the union across all jobs per workflow, every single workflow (292/292) grants write on at least one scope somewhere in its job graph — most commonly issues (292 write), pull-requests (142 write), contents (203 write), discussions (95 write). This is the expected gh-aw pattern: read-only agent job + narrowly-scoped write-capable safe-output jobs.

Engine distribution

Engine	Count	Share
copilot	147	50.3%
claude	61	20.9%
codex	46	15.8%
pi	21	7.2%
crush / aider / opencode / goose	3 each	4.1% combined
cursor / deepseek-harness / gemini / kiro / pydantic-ai	1 each	1.7% combined

0 workflows had an unresolvable engine. Top models: copilot/mai-code-1-flash-picker (32), copilot/gpt-5.4 (21), copilot/claude-sonnet-4.5 (12), gpt-5.4 (7), claude-sonnet-4.6 (5).

Tool & MCP patterns

safeoutputs MCP server is universal (292/292). Next most common: github (120), agenticworkflows (43), serena (25), mcpscripts (12), tavily (5). 0 workflows required the legacy manifest-less fallback for MCP detection.

Interesting findings

1. Near-universal manual trigger: 97.6% of workflows support workflow_dispatch, making almost every scheduled workflow independently re-runnable for debugging.
2. Write access is fully delegated: the agent job never holds write permissions directly — 100% of write capability lives in separate safe-output jobs, matching gh-aw's security model exactly.
3. audits is the default discussion category by a wide margin (79/92, 86%), suggesting most create_discussion workflows are self-reporting/monitoring agents like this one.
4. Schedule spread is deliberate: of 30 distinct cron patterns, only a handful repeat, and none cluster on :00/:30 — schedules are jittered across the day rather than bunched at common times.
5. Discussion-category extraction methodology changed this run: the previous script's safe_output_types field reported create-discussion: 290 (essentially every workflow), which conflicts with the mcp_tool_usage.create_discussion: 91 count in the same historical record. This run parses GH_AW_SAFE_OUTPUTS_CONFIG directly per-workflow (v4 schema) and gets create_discussion: 92, consistent with the tool-usage figure — the old aggregate count looks like it was inflated by counting the safe-outputs MCP tool surface rather than actual per-workflow configuration.

Historical trends (vs. 2026-08-23)

Metric	2026-08-23	2026-08-24	Δ
Lockfiles	290	292	+2
Total bytes	43,090,530	43,418,004	+327,474
Avg size	148,588	148,692	+104
copilot engine	145	147	+2
claude / codex / pi	61 / 46 / 21	61 / 46 / 21	0
workflow_dispatch_count	283	285	+2
workflows_with_any_write (union)	290	292	+2

The +2 lockfiles are consistent with +2 across copilot engine, workflow_dispatch, and union-write-count — pointing to two new copilot-engine workflows added between runs, both following the standard trigger/permission pattern. (Note: safe_output_types and discussion_categories are not compared numerically above because the extraction method changed — see finding #5.)

Recommendations

• No malformed lockfiles or unresolved engines/permissions this run — extraction pipeline is healthy.
• Consider periodically pruning single-use cron times if any of those workflows are deprecated, since ~20 of the 30 distinct cron patterns are single-workflow.
• If discussions: write is only needed by the 95 workflows shown in the union table, double check none of the other ~197 accidentally rely on a broader token — but this is already scoped correctly per the permission table above, so this is a confirmation note rather than an action item.

Methodology: single-script compact JSON analysis (lockfile_stats_v4.py), engine/permissions/safe-outputs derived from gh-aw-metadata/gh-aw-manifest comments, jobs.*.permissions, and GH_AW_SAFE_OUTPUTS_CONFIG env JSON rather than the always-empty top-level permissions: {} block.

References:

• §32772936336

Generated by 📊 Lockfile Statistics Analysis Agent · claude · agent · 49.3 AIC · ⌖ 9.82 AIC · ⊞ 8.5K · ◷

• expires on Aug 25, 2026, 12:25 PM UTC-08:00