[lockfile-stats] Lockfile Statistics — 2026-08-30

[github-actions[bot]]

Methodology: single-script compact JSON analysis (cached analyzer lockfile_stats_v4.py, reused from prior runs; engine from gh-aw-metadata comment, permissions from the agent job block, safe outputs from GH_AW_SAFE_OUTPUTS_CONFIG env JSON).

Executive summary

• 297 lockfiles analyzed, 0 skipped/malformed.
• Total size 43.2 MB (45,259,779 bytes), avg 148.8 KB/file, min 89.7 KB, max 234.3 KB.
• All self-checks passed: engine_unknown=0, permissions_unknown=0, safe_outputs_config_missing=0, discussion_category_detected=92 (== create_discussion_workflows=92), mcp_fallback_used_count=0.

File size distribution

Metric	Value
Count	297
Avg	152,389.8 bytes
Min	91,817 bytes
Max	239,880 bytes
Total	45,259,779 bytes

Trigger analysis

Trigger	Workflows
workflow_dispatch	289
schedule	240
pull_request	43
issues	5
issue_comment	3
workflow_call	3
discussion / discussion_comment / push / deployment_status / workflow_run / pull_request_review_comment	1 each

Top combinations: schedule+workflow_dispatch (207), workflow_dispatch only (38), pull_request+schedule+workflow_dispatch (29), pull_request+workflow_dispatch (9).

Cron cadence: the dominant schedule is 0 0 */2 * * (every 2 days) at 42 workflows; the remaining ~198 scheduled workflows use distinct, staggered cron expressions (long tail, mostly count=1–3), suggesting deliberate desync to avoid a thundering-herd of scheduled runs.

Safe outputs analysis

Safe output type	Workflows
create_issue	145
create_discussion	92
add_comment	77
create_pull_request	63
push_repo_memory	34
add_labels	32
upload_asset	26
create_pull_request_review_comment / submit_pull_request_review	16 each

(Baseline safe-output scaffolding — missing_data, missing_tool, noop, report_incomplete — present in 291/297 workflows.)

Discussion categories (92 create_discussion workflows, 100% resolved):

Category	Count
audits	79
announcements	5
artifacts	2
dev	2
research	2
general	1
daily-news	1

Structural characteristics

Metric	Avg	Max
Jobs/workflow	7.33	14
Steps/workflow	144.17	202
Scripts/workflow	99.26	133

Timeout distribution (step-level timeout-minutes, includes multiple steps per file): 10min → 316, 45min → 297, 60min → 290, 90min → 3, 5min → 2, 120min → 2, 180min → 1, 15min → 1.

Permission patterns (agent job)

Scope	read	write	none
contents	297	0	0
issues	259	0	38
pull-requests	254	0	43
actions	112	0	185
discussions	52	0	245
security-events	14	0	283
id-token	0	2	295

The agent job is consistently read-only or none across all standard scopes — all mutation happens via the safe-outputs mechanism, not direct job permissions. Union-across-jobs permissions show every workflow (297/297) grants write to at least one scope somewhere in the job graph (e.g. issues: write universally, contents: write in 204), reflecting the safe-output publishing jobs.

Engine distribution

Engine	Workflows
copilot	120
codex	75
claude	56
pi	29
crush / aider / opencode / goose	3 each
cursor / deepseek-harness / gemini / kiro / pydantic-ai	1 each

Top models: openai/gpt-5.4 (49), copilot/mai-code-1-flash-picker (44), copilot/claude-sonnet-4.5 (12).

Tool & MCP patterns

MCP server	Workflows
safeoutputs	297
github	120
agenticworkflows	44
serena	25
mcpscripts	12
tavily	5
sentry	3

Most-used individual tools: safeoutputs:missing_data/missing_tool/noop (291 each), safeoutputs:create_issue (145), github:get_commit/get_file_contents/etc. (118 each, GitHub read tool bundle).

Interesting findings

1. Engine mix shifted noticeably day-over-day: copilot 151→120 (−31), codex 46→75 (+29), claude 61→56 (−5), pi 22→29 (+7) since 2026-08-29 — a substantial reshuffle in one day, likely a bulk engine-migration change rather than organic drift.
2. Every one of the 297 workflows relies on the safeoutputs MCP server and none show a direct write permission in the agent job — a clean, consistently-enforced separation between "agent reasoning" (read-only) and "side effects" (safe-output publishing jobs).
3. create_discussion category assignment is 100% resolved (92/92) with audits dominating (79/92, ~86%) — this very report belongs to that dominant category.
4. Scheduling is deliberately desynchronized: only one cron pattern (0 0 */2 * *) repeats at scale (42×); the rest of the ~240 scheduled workflows use unique per-workflow offsets.
5. Structural complexity is high and fairly uniform: avg 144 steps and 99 embedded scripts per compiled lockfile, with a max of 202 steps — these are heavily-templated, code-generated workflows, not hand-authored YAML.

Historical trends (vs. 2026-08-29)

Metric	Prev	Current	Δ
Lockfiles	297	297	0
Total bytes	45,044,163	45,259,779	+215,616
Avg size	151,663.8	152,389.8	+726.0
workflow_dispatch count	289	289	0
create_discussion workflows	92	92	0
Engine: copilot	151	120	−31
Engine: codex	46	75	+29
Engine: claude	61	56	−5
Engine: pi	22	29	+7
Avg steps/workflow	143.88	144.17	+0.29
github MCP server workflows	121	120	−1

Discussion category mix, safe-output type mix, and job/script averages were otherwise stable day-over-day — the engine reshuffle is the standout change.

Recommendations

• Investigate the copilot→codex/pi engine shift (−31/+29/+7 in a single day) to confirm it was an intentional migration and not a misconfigured default falling back unexpectedly.
• Consider consolidating the long tail of near-unique cron schedules if any were auto-generated rather than deliberately staggered — verify desync is intentional, not accidental drift.
• The 205 workflows without discussions: read in the agent job but with create_discussion further down the pipeline confirms safe-outputs correctly isolates discussion writes; no permission-hardening action needed there.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by 📊 Lockfile Statistics Analysis Agent · claude · agent · 88.8 AIC · ⌖ 9.04 AIC · ⊞ 8.5K · ◷

• expires on Aug 31, 2026, 12:27 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Lockfile Statistics Analysis Agent.

A newer discussion is available at Discussion #57504.