[lockfile-stats] Lockfile statistics — 2026-09-03

[github-actions[bot]]

Analysis of 298 compiled .github/workflows/*.lock.yml files (0 malformed/skipped). Methodology: single-script compact JSON analysis (cached analyzer, schema v4).

Key metrics

Metric	Value	Δ vs 2026-09-02
Lockfiles	298	+0
Total size	45,609,696 bytes (~43.5 MB)	+169,170 bytes (+0.37%)
Avg size	153,053 bytes	+568
Min / Max size	92,014 / 244,926 bytes	+191 / +421
Avg jobs/steps/scripts per workflow	7.34 / 144.42 / 99.43	+0.01 / +0.14 / +0.07
Max jobs/steps/scripts	14 / 205 / 136	unchanged

Trigger analysis

• workflow_dispatch: 290, schedule: 241, pull_request: 43 (dominant triggers)
• Top combination: schedule+workflow_dispatch (208 workflows), then workflow_dispatch alone (38), then pull_request+schedule+workflow_dispatch (29)
• Most common cron: 0 0 */2 * * (every 2 days) — 42 workflows

Safe outputs analysis

• create_discussion_workflows: 92, all 92 resolved to a category (discussion_category_detected = 92, 0 unresolved) — self-check passed
• Discussion categories: audits (79), announcements (5), artifacts (2), dev (2), research (2), general (1), daily-news (1)
• Most common non-baseline safe outputs: create_issue (146, +1 vs prior day), create_discussion (92), add_comment (77), create_pull_request (64)
• safe_outputs_config_missing: 0 (config extracted from every lockfile)

Permission patterns (agent job)

Scope	read	write	none
contents	298	0	0
issues	260	0	38
pull-requests	255	0	43
actions	113	0	185
discussions	52	0	246

permissions_unknown: 0 — all 298 agent jobs parsed. Union-of-all-jobs shows 298/298 workflows grant some write scope (mostly via the safe-output post-processing jobs), vs. the read-mostly agent job itself — expected, since safe-output jobs perform the actual writes.

Engine distribution

copilot (120), codex (76), claude (56), pi (29), crush/aider/opencode/goose (3 each), cursor/deepseek-harness/gemini/kiro/pydantic-ai (1 each). engine_unknown: 0.

Tool & MCP patterns

• safeoutputs MCP present in all 298 workflows; github MCP in 120; agenticworkflows in 44; serena in 25
• Most-used non-safeoutput tool: github:get_commit/get_file_contents/etc. (118 workflows each)
• mcp_fallback_used_count: 0 (manifest-based detection worked for all lockfiles)

Interesting findings

1. Near-zero week-over-week churn: comparing to 2026-09-02, only total_bytes (+0.37%), create_issue count (+1), and averages shifted marginally — the fleet of 298 lockfiles is stable, no new/removed workflows in the last day.
2. Audits dominate discussion output: 79 of 92 create_discussion workflows (86%) post to the audits category — this very report included.
3. copilot is the leading engine (120/298, 40%) ahead of codex (76) and claude (56), despite claude models otherwise appearing across model strings (claude-sonnet-5, claude-opus-4.8, etc.) — engine choice and model string diverge for copilot-branded agents.
4. Permission hygiene looks solid: 0 agent jobs grant write on contents, issues, discussions, etc. at the primary agent-job level — all direct write actions are deferred to dedicated safe-output jobs (100% union write coverage vs. 0% agent-job write).
5. Cron clustering: 42 workflows (14%) share the exact same 0 0 */2 * * schedule, suggesting a common default/template cadence.

Recommendations

• No corrective action needed — self-checks passed (yaml parse OK, safe-output config found for all lockfiles, discussion categories fully resolved).
• Given 42 workflows share an identical cron slot, consider jittering schedules to smooth GitHub Actions runner load at that instant.
• Continue daily snapshots; the low day-over-day variance makes this a good baseline for detecting anomalies (e.g. a sudden permission-scope change or new engine appearing).

Methodology note: single-script compact JSON analysis.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by 📊 Lockfile Statistics Analysis Agent · claude · agent · 77 AIC · ⌖ 8.9 AIC · ⊞ 8.5K · ◷

• expires on Sep 4, 2026, 12:28 PM UTC-08:00