[lockfile-stats] Lockfile Statistics — 2026-09-06 (299 workflows analyzed)

[github-actions[bot]]

Lockfile Statistics — 2026-09-06

299 compiled workflows analyzed, 44.0 MB total (avg 154.0 KB, range 90–239 KB). No malformed files skipped. All engines, permissions, and safe-output configs resolved (0 unknown).

File size distribution

Metric	Value
Count	299
Total	46,032,735 bytes
Avg	153,955.6 bytes
Min	92,111 bytes
Max	245,217 bytes

Trigger analysis

Trigger	Workflows
workflow_dispatch	291
schedule	242
pull_request	43
issues	5
issue_comment / workflow_call	3 each
deployment_status / workflow_run / discussion / discussion_comment / push / pull_request_review_comment	1 each

Top combination: schedule+workflow_dispatch (209 workflows). Most common cron: 0 0 */2 * * (every 2 days, 42 workflows).

Safe outputs analysis

• create_discussion: 92 workflows — all 92 resolved a category (0 unresolved).
  • Categories: audits (79), announcements (5), artifacts (2), dev (2), research (2), general (1), daily-news (1).
• create_issue: 146, add_comment: 77, create_pull_request: 64, add_labels: 32, upload_asset: 26.
• safe_outputs_config_missing: 0 (config found in every lockfile).

Structural characteristics

Metric	Avg	Max
Jobs/workflow	7.35	14
Steps/workflow	144.0	205
Scripts/workflow	98.94	136

Timeout distribution: 45 min (299 — one per workflow's agent job), 60 min (292), 10 min (318 occurrences across sub-steps), few outliers up to 180 min.

Permission patterns (agent job)

Scope	read	none	write
contents	299	–	–
issues	260	39	–
pull-requests	255	44	–
actions	114	185	–
discussions	52	247	–
security-events	14	285	–
id-token	–	297	2

Agent jobs are consistently read-only/least-privilege; write access is granted only via the union of downstream jobs (299/299 workflows have some job with a write scope — safe-output write jobs run isolated from the agent job).

Engine distribution

Engine	Count
copilot	123
codex	94
claude	56
pi	11
aider / opencode / goose	3 each
crush / cursor / deepseek-harness / gemini / kiro / pydantic-ai	1 each

engine_unknown: 0. Top models: copilot/gpt-5.3-codex (47), openai/gpt-5.4 (43), copilot/claude-sonnet-4.5 (9).

Tool & MCP patterns

Server	Workflows
safeoutputs	299
github	188
agenticworkflows	44
serena	25
mcpscripts	12
tavily	5

mcp_fallback_used_count: 0 (manifest-based detection succeeded for all files).

Interesting findings

1. Every single workflow (299/299) grants a write scope to some job — but the agent job itself stays read-only in the vast majority (contents: 299/299 read, 0 write) — a clean separation between "thinking" and "writing" steps via safe-outputs.
2. create_discussion category detection is 100% (92/92) — no fallback regex parsing was needed anywhere in the corpus.
3. copilot is the plurality engine (41% of workflows) followed by codex (31%) and claude (19%); 7 other engines share the remaining ~10%.
4. schedule+workflow_dispatch is by far the dominant trigger pattern (70% of workflows), suggesting most agentic workflows are designed for both cron-driven and manual runs.
5. The github MCP server appears in 188/299 (63%) workflows, making it the most common non-safeoutputs tool integration.

Historical trends (vs 2026-09-05)

Metric	2026-09-05	2026-09-06	Δ
Lockfile count	299	299	0
Total bytes	46,033,897	46,032,735	-1,162
Avg step count	143.99	144.0	+0.01
Avg script count	98.93	98.94	+0.01
github MCP server workflows	189	188	-1
create_discussion workflows	92	92	0
engine_unknown / permissions_unknown	0 / 0	0 / 0	–

Corpus is essentially stable day-over-day; the only notable shift is one workflow dropping (or another gaining) the github MCP server.

Recommendations

• No malformed lockfiles or unresolved detections this run — parsing pipeline is healthy.
• Consider standardizing timeout values further: most workflows already converge on 45/60 min, but a handful of outliers (90/120/180 min) could be reviewed for necessity.
• Given github MCP server dropped by 1 workflow, spot-check recent commits touching MCP server config for unintended removals.

Methodology: single-script compact JSON analysis (lockfile_stats_v4.py, cached in /tmp/gh-aw/cache-memory/scripts/), reused unchanged from prior runs; summary written to /tmp/gh-aw/agent/lockfile-stats-summary.json and archived to /tmp/gh-aw/cache-memory/history/2026-09-06.json.

References:

• §34057643507

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by 📊 Lockfile Statistics Analysis Agent · claude · agent · 81.2 AIC · ⌖ 9.72 AIC · ⊞ 8.5K · ◷

• expires on Sep 7, 2026, 12:27 PM UTC-08:00