[lockfile-stats] Lockfile Statistics — 2026-09-02

[github-actions[bot]]

Analysis of all compiled .github/workflows/*.lock.yml files in github/gh-aw, generated by a single-script compact JSON analysis (§33678860549).

Executive summary

Metric	Value
Lockfiles analyzed	298 (0 skipped/malformed)
Total size	45,440,526 bytes (~43.3 MB)
Avg / min / max size	152,485 / 91,823 / 244,505 bytes
yaml_available	true

File size distribution

Sizes are tightly clustered — no outliers below 90 KB or above 245 KB, consistent with a shared code-generation template across workflows.

Stat	Bytes
Min	91,823
Avg	152,485
Max	244,505

Trigger analysis

Trigger	Workflows
workflow_dispatch	290
schedule	241
pull_request	43
issues	5
issue_comment	3
workflow_call	3
discussion / discussion_comment / push / deployment_status / workflow_run / pull_request_review_comment	1 each

Top trigger combinations: schedule+workflow_dispatch (208), workflow_dispatch only (38), pull_request+schedule+workflow_dispatch (29), pull_request+workflow_dispatch (9).

Cron cadence is dominated by 0 0 */2 * * (every 2 days) at 42 workflows; the remaining 29 distinct cron expressions each appear 1-3 times, indicating mostly bespoke schedules apart from that one common cadence.

Safe outputs analysis

Every analyzable workflow (292/298) ships the baseline safe-output set (missing_data, missing_tool, noop, report_incomplete, create_report_incomplete_issue). Beyond the baseline, the most common write actions are:

Safe output type	Workflows
create_issue	145
create_discussion	92
add_comment	77
create_pull_request	64
push_repo_memory	34
add_labels	32
upload_asset	26

Discussion categories (92 create_discussion workflows, 92/92 categories resolved, 0 unresolved, 0 fallback-parsed):

Category	Workflows
audits	79
announcements	5
artifacts	2
dev	2
research	2
general	1
daily-news	1

safe_outputs_config_missing: 0 — every lockfile's GH_AW_SAFE_OUTPUTS_CONFIG was resolved via YAML parse (no regex fallback needed).

Structural characteristics

Metric	Avg	Max
Jobs / workflow	7.33	14
Steps / workflow	144.28	205
Script (run) steps / workflow	99.36	136

Timeout-minutes distribution (max across jobs per workflow, so totals exceed 298): 10min → 317, 45min → 298, 60min → 291, 90min → 3, 5min → 2, 120min → 2, 180min → 1, 15min → 1 — nearly every workflow layers a short (10min) job alongside a longer 45-60min agent job.

Permission patterns (agent job)

permissions_unknown: 0 — all 298 agent-job permission blocks parsed.

Scope	read	write	none
contents	298	–	–
issues	260	–	38
pull-requests	255	–	43
actions	113	–	185
discussions	52	–	246
security-events	14	–	284
id-token	–	2	296
checks / deployments / packages	1	–	297
pages / repository-projects / statuses / attestations	–	–	298

The agent job itself never holds write permissions directly — all writes go through the union of other jobs (e.g. a dedicated safe-output-apply job), where issues: write appears in all 298 workflows and contents: write in 205.

Engine distribution

(resolved from gh-aw-metadata agent_id, engine_unknown: 0)

Engine	Workflows
copilot	120
codex	76
claude	56
pi	29
crush / aider / opencode / goose	3 each
cursor / deepseek-harness / gemini / kiro / pydantic-ai	1 each

Top models: openai/gpt-5.4 (48), copilot/mai-code-1-flash-picker (44), copilot/claude-sonnet-4.5 (11), claude-sonnet-5 (6), claude-haiku-4.5 (4).

Tool & MCP patterns

safeoutputs is wired into all 298 workflows (as expected). Other MCP servers in use: github (120), agenticworkflows (44), serena (25), mcpscripts (12), tavily (5), sentry (3), plus single-digit usage of ast-grep, datadog, deepwiki, microsoftdocs, grafana, mempalace, graft, agentdb, ruflo. No MCP-manifest fallback parsing was needed (mcp_fallback_used_count: 0).

Interesting findings

1. No structural drift day-over-day: lockfile count, trigger mix, engine distribution, permission scopes, and MCP server usage are byte-for-byte identical to 2026-09-01 — the only changes are a handful of model-string updates and a tiny size increase.
2. Model migration in progress: claude-sonnet-4.6 (5 workflows on 09-01) has fully migrated to claude-sonnet-5 (1→6 workflows), alongside a 1-workflow shift off copilot/claude-sonnet-4.5 and openai/gpt-5.4. Net size grew by 770 bytes and max lockfile size by 115 bytes, consistent with a small in-place engine/model bump rather than a new feature.
3. Agent job permissions are deliberately minimal: every one of the 298 agent jobs holds only contents: read plus scoped reads — no agent job ever holds a write permission directly. All writes are isolated into separate jobs, matching the safe-outputs security model.
4. copilot is the plurality engine (120/298, 40%) but codex (76) and claude (56) are both substantial, and 8 other engines (pi, crush, aider, opencode, goose, cursor, deepseek-harness, gemini, kiro, pydantic-ai) each appear in at least one workflow — this repo exercises a very wide engine matrix.
5. audits-category discussions dominate (79 of 92 create_discussion workflows, 86%) — this workflow itself publishes into that category, consistent with the bulk of discussion-producing workflows being periodic audit/reporting jobs rather than announcements or research notes.

Historical trends (vs. 2026-09-01)

Metric	2026-09-01	2026-09-02	Δ
Lockfiles	298	298	0
Total bytes	45,439,756	45,440,526	+770
Max size	244,390	244,505	+115
claude-sonnet-4.6 models	5	0	−5
claude-sonnet-5 models	1	6	+5
openai/gpt-5.4 models	49	48	−1
copilot/claude-sonnet-4.5 models	12	11	−1
Everything else (triggers, permissions, engines, MCP)	—	—	unchanged

Recommendations

• No action needed on structure/permissions — the permission model (agent job read-only, writes isolated) is consistent across all 298 workflows.
• Continue tracking the claude-sonnet-4.6 → claude-sonnet-5 migration; if any workflows are still pinned to the older name intentionally (vs. missed in a bulk rename), confirm before the next audit cycle.
• Consider consolidating the 29 distinct one-off cron expressions if the underlying schedules don't require sub-minute-specific offsets — most already avoid :00/:30 collision, so this is a minor observation, not a problem.

Methodology: single-script compact JSON analysis (lockfile_stats_v4.py, cached at /tmp/gh-aw/cache-memory/scripts/).

References:

• §33678860549

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by 📊 Lockfile Statistics Analysis Agent · claude · agent · 86.3 AIC · ⌖ 10 AIC · ⊞ 8.5K · ◷

• expires on Sep 3, 2026, 12:30 PM UTC-08:00