[lockfile-stats] Lockfile statistics audit — 2026-09-08 (299 workflows)

[github-actions[bot]]

Overview

Analyzed 299 compiled lockfiles (.github/workflows/*.lock.yml) in github/gh-aw on 2026-09-08. Total size 46,081,246 bytes (~44.0 MB), avg 154,117.9 B, min 92,081 B, max 245,187 B. 0 malformed/skipped. Methodology: single-script compact JSON analysis (cached analyzer lockfile_stats_v4.py).

File size distribution

Metric	Value
Count	299
Total bytes	46,081,246
Avg	154,117.9
Min	92,081
Max	245,187

Trigger analysis

Trigger	Count
workflow_dispatch	291
schedule	242
pull_request	43
issues	5
issue_comment	3
workflow_call	3
deployment_status / workflow_run / discussion / discussion_comment / push / pull_request_review_comment	1 each

Top combinations: schedule+workflow_dispatch (209), workflow_dispatch only (38), pull_request+schedule+workflow_dispatch (29), pull_request+workflow_dispatch (9). workflow_dispatch present in 291/299 workflows (97%). Most common cron: 0 0 */2 * * (every 2 days) in 42 workflows; remaining crons are mostly daily/hourly one-offs.

Safe outputs analysis

create_discussion_workflows = 92, all 92 resolved a category (discussion_category_detected = 92, 0 unresolved, 0 fallback-parsed). safe_outputs_config_missing = 0 (config found in every lockfile). This is the "detection succeeded" case, not "no discussion workflows configured."

Discussion categories: audits (79), announcements (5), artifacts (2), dev (2), research (2), general (1), daily-news (1).

Top non-baseline safe-output types (baseline noop/missing_data/missing_tool/report_incomplete present in 293 workflows each): create_issue (146), create_discussion (92), add_comment (77), create_pull_request (64), push_repo_memory (36), add_labels (32), upload_asset (26).

Structural characteristics

Metric	Avg	Max
Jobs/workflow	7.35	14
Steps/workflow	144.47	205
Run-scripts/workflow	99.04	136

Timeout-minutes distribution (per job, across workflows): 10→318, 45→299, 60→292, 90→3, 5→2, 120→2, 180→1, 15→1.

Permission patterns (agent job)

permissions_unknown = 0 — resolved for every workflow from jobs.agent.permissions.

Scope	read	write	none
contents	299	0	0
issues	260	0	39
pull-requests	255	0	44
actions	114	0	185
discussions	52	0	247
security-events	14	0	285
id-token	0	2	297
checks/deployments/packages	1 each	0	298
pages/repository-projects/statuses/attestations	0	0	299

Agent jobs are consistently read-only or none — all write scopes are delegated elsewhere. Union-across-all-jobs view confirms this: every workflow (299/299) grants some write scope somewhere in its job graph (union_any_write_count = 299), most commonly issues:write (299/299) and contents:write (206/299) — i.e. the write-capable safe-output jobs are isolated from the read-only agent job by design.

Engine distribution

(from gh-aw-metadata agent_id, engine_unknown = 0)

Engine	Count
copilot	123
codex	94
claude	56
pi	11
aider / opencode / goose	3 each
crush / cursor / deepseek-harness / gemini / kiro / pydantic-ai	1 each

Top models: copilot/gpt-5.3-codex (47), openai/gpt-5.4 (43), copilot/claude-sonnet-4.5 (9), openai/gpt-5.3-codex (6), claude-sonnet-5 (6).

Tool & MCP patterns

MCP servers by workflow count: safeoutputs (299, universal), github (188), agenticworkflows (44), serena (25), mcpscripts (12), tavily (5), sentry/ast-grep/datadog/deepwiki/microsoftdocs/grafana (≤3 each). No legacy fallback parsing was needed (mcp_fallback_used_count = 0) — all servers resolved from the gh-aw-manifest header.

Interesting findings

1. Universal read-only agent sandboxing: 0 workflows grant any write permission directly to the agent job (100% none/read only), yet 299/299 achieve write effects via the union of jobs — a clean separation between "the model that reasons" and "the job that writes."
2. workflow_dispatch is near-universal (291/299, 97%) even though most workflows are schedule-driven — nearly every automation is also manually triggerable.
3. copilot is the plurality engine (123/299, 41%) ahead of codex (94) and claude (56), despite this being an Anthropic-adjacent tooling repo.
4. audits dominates discussion categories — 79 of 92 create_discussion workflows (86%) post to audits, suggesting a strong convention for periodic analysis reports like this one.
5. Structural footprint is large: workflows average 144 steps and 99 embedded scripts each, with one workflow reaching 205 steps / 136 scripts — compiled lockfiles are substantially more complex than their source frontmatter.

Historical trends (vs 2026-09-07)

Metric	2026-09-07	2026-09-08	Δ
Lockfile count	299	299	0
Total bytes	46,032,735	46,081,246	+48,511 (+0.11%)
Avg size	153,955.6	154,117.9	+162.3
Min size	92,111	92,081	−30
Max size	245,217	245,187	−30
Avg steps/workflow	144.0	144.47	+0.47
Avg scripts/workflow	98.94	99.04	+0.10

Triggers, safe-output types, discussion categories, engine distribution, permission scopes, timeout distribution, and MCP server/tool usage are unchanged day-over-day — only minor size/step drift consistent with routine recompilation.

Recommendations

• Given the consistent read-only agent-job pattern, this separation of concerns looks intentional and healthy — no action needed, but worth documenting as an explicit convention for new workflow authors.
• The audits category concentration (86% of discussion workflows) suggests consolidating audit-discussion tooling/templates if not already shared.
• No malformed lockfiles or unresolved detections this run — parser health is good; no immediate follow-up required.

Methodology: single-script compact JSON analysis.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by 📊 Lockfile Statistics Analysis Agent · claude · agent · 68.4 AIC · ⌖ 8.26 AIC · ⊞ 8.5K · ◷

• expires on Sep 9, 2026, 12:27 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Lockfile Statistics Analysis Agent.

A newer discussion is available at Discussion #59802.