[lockfile-stats] Lockfile Statistics Report — 2026-09-04 (299 workflows)

[github-actions[bot]]

Overview

Analyzed 299 compiled .github/workflows/*.lock.yml files on 2026-09-04 (0 skipped/malformed). Total size 43.68 MB (45,801,415 bytes), avg 149.6 KB, min 90.0 KB, max 239.5 KB.

Methodology: single-script compact JSON analysis (analyzer cached at /tmp/gh-aw/cache-memory/scripts/lockfile_stats_v4.py, re-used across runs; full summary at /tmp/gh-aw/agent/lockfile-stats-summary.json).

Key metrics

Metric	Value
Lockfiles analyzed	299 (0 skipped)
Total size	43.68 MB
Avg / min / max size	149.6 KB / 90.0 KB / 239.5 KB
Avg jobs / max jobs	7.33 / 14
Avg steps / max steps	144.3 / 205
Avg script steps / max	99.37 / 136
Engine unresolved	0
Permissions unresolved	0
Safe-outputs config missing	0
create_discussion workflows w/ category detected	92 / 92 (100%)

Trigger analysis

Trigger	Count
workflow_dispatch	291
schedule	242
pull_request	43
issues	5
issue_comment	3
workflow_call	3
workflow_run, deployment_status, discussion, discussion_comment, push, pull_request_review_comment	1 each

Top trigger combinations: schedule+workflow_dispatch (209), workflow_dispatch only (38), pull_request+schedule+workflow_dispatch (29), pull_request+workflow_dispatch (9).

Top cron cadence: 0 0 */2 * * (every 2 days) dominates at 42 workflows; remaining schedules are mostly unique daily/weekly crons.

Safe outputs analysis

Nearly universal safe-output types (present on ~293/299 workflows — the standard scaffold): missing_data, missing_tool, noop, report_incomplete, create_report_incomplete_issue.

Most common feature safe-outputs:

Type	Workflows
create_issue	146
create_discussion	92
add_comment	77
create_pull_request	64
push_repo_memory	34
add_labels	32
upload_asset	26

Discussion categories (92 workflows, 100% resolved): audits (79), announcements (5), artifacts (2), dev (2), research (2), general (1), daily-news (1).

New/rare integrations spotted this run: jira_create_issue and linear_create_issue (1 workflow each — new since 2026-09-03).

Structural characteristics

• Avg jobs/workflow: 7.33 (max 14)
• Avg steps/workflow: 144.3 (max 205)
• Avg script (run:) steps/workflow: 99.37 (max 136)
• Timeout-minutes distribution across jobs: 10min ×318, 45min ×299, 60min ×292, 90min ×3, 5min ×2, 120min ×2, 180min ×1, 15min ×1

Permission patterns (agent job)

Scope	read	write	none
contents	299	0	0
issues	260	0	39
pull-requests	255	0	44
actions	114	0	185
discussions	52	0	247
security-events	14	0	285
id-token	0	2	297

All 299 workflows keep the agent job read-only on contents; write access is granted only via the union of other jobs. Union-of-all-jobs shows 299/299 workflows grant at least one write scope somewhere (mostly issues: write on all 299, and contents: write on 205) — consistent with the safe-outputs pattern where a separate privileged job performs writes on the agent's behalf.

Engine distribution

Engine	Count
copilot	121
codex	76
claude	56
pi	29
crush / aider / opencode / goose	3 each
cursor / deepseek-harness / gemini / kiro / pydantic-ai	1 each

Top models: openai/gpt-5.4 (48), copilot/mai-code-1-flash-picker (44), copilot/claude-sonnet-4.5 (11), claude-sonnet-5 (6).

Tool & MCP patterns

MCP servers: safeoutputs (299, universal), github (121), agenticworkflows (44), serena (25), mcpscripts (12), tavily (5), sentry/datadog/deepwiki/microsoftdocs/grafana/ast-grep (2-3 each), several single-use integrations (mempalace, graft, agentdb, ruflo).

Most-used GitHub MCP read tools: get_commit, get_file_contents, get_latest_release, list_commits, search_code (119 workflows each); PR-focused tool bundle (get_pull_request*, pull_request_read, etc.) at 113 workflows.

Interesting findings

1. Permission discipline is strong: every single agent job (299/299) is read-only on contents, with all writes routed through the safe-outputs mechanism — no direct write-capable agent jobs found.
2. Bi-daily cron is the dominant cadence: 0 0 */2 * * alone accounts for 42 of ~91 distinct cron schedules, suggesting a shared default template rather than per-workflow tuning.
3. Copilot overtook Codex as the top engine this run (121 vs 76), with Claude in third (56) — a 1-workflow gain for Copilot since 2026-09-03.
4. Audits is the dominant discussion category by a wide margin (79 of 92 create_discussion workflows, 86%), meaning this very report's category is the norm, not the exception.
5. New third-party issue-tracker integrations appeared: jira_create_issue and linear_create_issue each showed up for the first time since 2026-09-03, alongside a net +1 lockfile and +1 github MCP server user.

Historical trends (vs 2026-09-03)

Metric	2026-09-03	2026-09-04	Δ
Lockfiles	298	299	+1
Total bytes	45,609,696	45,801,415	+191,719 (+0.42%)
workflow_dispatch triggers	290	291	+1
schedule triggers	241	242	+1
copilot engine	120	121	+1
github MCP server users	120	121	+1
create_discussion workflows	92	92	0
Safe-output types (distinct)	51	53	+2 (jira_create_issue, linear_create_issue)

Day-over-day change is minimal: one new workflow added (Copilot-engine, GitHub MCP, Jira/Linear issue creation), no regressions in engine/permission/safe-output detection.

Recommendations

• Consider consolidating the ~91 distinct near-duplicate cron schedules where feasible — the long tail of unique minute/hour offsets (many singletons) looks like auto-generated jitter rather than intentional scheduling diversity.
• Since discussions overwhelmingly land in audits (86%), confirm this is intentional taxonomy rather than a default nobody overrides.
• No parser reliability issues to flag this run: 0 skipped lockfiles, 0 unresolved engines/permissions/safe-output configs.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by 📊 Lockfile Statistics Analysis Agent · claude · agent · 75.3 AIC · ⌖ 8.92 AIC · ⊞ 8.5K · ◷

• expires on Sep 5, 2026, 12:29 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Lockfile Statistics Analysis Agent.

A newer discussion is available at Discussion #58866.