[lockfile-stats] Lockfile Statistics Report — 2026-08-27 (295 workflows)

[github-actions[bot]]

Overview

Analyzed 295 compiled lockfiles (.github/workflows/*.lock.yml) as of 2026-08-27. Total size 42.9 MB (44,954,453 bytes), avg 152.4 KB/file (min 90.1 KB, max 239.8 KB). No malformed files skipped. Methodology: single-script compact JSON analysis (cached analyzer reused, no per-file cat/grep).

Key metrics

Dimension	Result
Lockfiles	295 (yaml parse OK: 295, skipped: 0)
Dominant trigger combo	schedule+workflow_dispatch — 206 (70%)
workflow_dispatch present	287 (97%)
schedule present	239 (81%)
Top cron	0 0 */2 * * (every 2 days) — 42 workflows
Engines	copilot 148 (50%), claude 62 (21%), codex 47 (16%), pi 21 (7%), + 9 others ≤3 each. engine_unknown: 0
create_discussion workflows	92 — categories resolved for 92/92 (100%)
Top discussion category	audits — 79/92 (86%)
Universal safe-output scaffolding	noop/missing_data/missing_tool/report_incomplete in 289/295 (98%)
Agent job contents permission	read in 295/295 (0 direct write)
Any job grants write (union)	295/295 (100%)
MCP servers	safeoutputs 295 (100%), github 122 (41%), agenticworkflows 44 (15%), serena 25

Trigger analysis

• Trigger frequency: workflow_dispatch 287, schedule 239, pull_request 43, issues 5, issue_comment 3, workflow_call 2, and 6 others at 1 each (deployment_status, workflow_run, discussion, discussion_comment, push, pull_request_review_comment).
• Top combinations: schedule+workflow_dispatch 206, workflow_dispatch alone 38, pull_request+schedule+workflow_dispatch 29, pull_request+workflow_dispatch 9.
• Cron long-tail: besides the dominant every-2-days cadence (42), most other crons are unique per-workflow daily/weekday schedules (1-3 occurrences each) — the fleet is largely decorrelated in exact fire time.

Safe outputs analysis

Full safe-output type counts (top 15)

Type	Count
create_report_incomplete_issue / missing_data / missing_tool / noop / report_incomplete	289 each
create_issue	143
create_discussion	92
add_comment	77
create_pull_request	63
push_repo_memory	34
add_labels	32
upload_asset	26
mentions	23
create_pull_request_review_comment / submit_pull_request_review	16 each
upload_artifact / create_check_run	14 each

Discussion categories (92 create_discussion workflows, all resolved): audits 79, announcements 5, artifacts 2, dev 2, research 2, general 1, daily-news 1. Detection gap: 0. safe_outputs_config_missing: 0.

Structural characteristics

• Jobs/workflow: avg 7.33, max 14.
• Steps/workflow: avg 144.09, max 202.
• Script (run:) steps/workflow: avg 99.26, max 133.
• Timeout distribution (per job, minutes): 10→313, 45→296, 60→289, 90→3, 5→2, 120→2, 180→1.

Permission patterns

From jobs.agent.permissions (not the always-empty top-level block):

• contents: read 295, write 0 — the agent job never holds direct write access.
• issues: read 258 / none 37. pull-requests: read 254 / none 41. discussions: none 243 / read 52.
• actions: read 111 / none 184. id-token: write 2 / none 293. checks/deployments/packages: read 1 each, else none.
• permissions_unknown: 0 (agent-job permissions parsed for all 295).

Union across all jobs per workflow (captures the privileged safe-output-apply job): issues write 295/295 (100%), contents write 205 (70%), pull-requests write 144, discussions write 95, actions write 105. union_any_write_count: 295/295 — every workflow grants write somewhere, confirming a consistent least-privilege-agent + privileged-apply-job pattern.

Engine distribution

copilot 148, claude 62, codex 47, pi 21, crush 3, aider 3, opencode 3, goose 3, cursor 1, deepseek-harness 1, gemini 1, kiro 1, pydantic-ai 1. engine_unknown: 0.

Top models: copilot/mai-code-1-flash-picker 33, copilot/gpt-5.4 23, copilot/claude-sonnet-4.5 12, gpt-5.4 6, claude-sonnet-4.6 5.

Tool & MCP patterns

safeoutputs (295, 100%), github (122, 41%), agenticworkflows (44, 15%), serena (25), mcpscripts (12), tavily (5), sentry (3), plus single-digit usage of ast-grep, datadog, deepwiki, microsoftdocs, grafana, mempalace, graft, agentdb, ruflo. mcp_fallback_used_count: 0 (manifest-based detection succeeded for every lockfile).

Interesting findings

1. Two-tier permission model is universal: the agent job never holds contents:write directly (295/295 read-only), yet 100% of workflows grant write somewhere in the job graph — every workflow relies on a separate privileged job to apply safe outputs.
2. Copilot leads engine share at 50% (148/295), with claude (21%) and codex (16%) next; 9 other engines each account for ≤3 workflows — a long tail of experimentation.
3. audits dominates discussion output — 79 of 92 create_discussion workflows (86%) post to the audits category, this report included.
4. Universal safety scaffolding: noop/missing_data/missing_tool/report_incomplete appear in 289/295 workflows (98%), indicating a near-fleet-wide standard for graceful-failure signaling.
5. Cron cadence is mostly decorrelated: aside from a 42-workflow cluster on a 2-day cycle, the remaining ~200 scheduled workflows use distinct times, spreading load rather than clustering at common hours.

Historical trends (vs 2026-08-26)

Metric	2026-08-26	2026-08-27	Δ
Lockfiles	294	295	+1
Total bytes	44,272,954	44,954,453	+681,499 (+1.5%)
workflow_dispatch count	286	287	+1
create_discussion workflows	92	92	0
claude engine	61	62	+1
github MCP usage	121	122	+1
agenticworkflows MCP usage	43	44	+1
Steps/workflow avg	143.24	144.09	+0.85
Universal safe-output types (e.g. noop)	288	289	+1

The single new lockfile added between runs uses claude as its engine, the schedule+workflow_dispatch trigger pair, and the full standard safe-output scaffold (including upload_artifact, which also moved 13→14) — consistent with one new scheduled Claude-based workflow onboarding the standard template.

Recommendations

• Verify the two id-token: write workflows are OIDC-only and don't carry other unnecessarily broad grants.
• The 3 workflows with 120–180 min job timeouts are outliers vs the 10/45/60-min norm — worth a cost/runaway-risk check.
• Since audits now holds 86% of discussion output, consider a sub-category or tag scheme if this category keeps growing, to keep the discussions board navigable.
• 98% safe-output scaffolding coverage but only 31% (92/295) actually produce discussions — confirm the remaining workflows' noop/failure paths are being monitored somewhere (e.g. issue creation or dashboards), not just silently absorbed.

Methodology note

Single-script compact JSON analysis: one cached Python analyzer (lockfile_stats_v4.py) parsed every .lock.yml in one pass via yaml.safe_load, extracting engine (gh-aw-metadata comment), safe-output config (GH_AW_SAFE_OUTPUTS_CONFIG env JSON), per-job permissions, and MCP manifest data. No individual lockfile was opened outside that script. Self-checks (category-resolution gap, safe-outputs-config coverage, engine/permission resolution) all passed with zero unresolved cases.

References:

• §33125651474

Generated by 📊 Lockfile Statistics Analysis Agent · claude · agent · 64.5 AIC · ⌖ 8.81 AIC · ⊞ 8.5K · ◷

• expires on Aug 28, 2026, 3:25 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Lockfile Statistics Analysis Agent.

A newer discussion is available at Discussion #56724.