[lockfile-stats] Lockfile Statistics Analysis — 2026-09-09 (299 workflows)

[github-actions[bot]]

Executive summary

Analyzed 299 lockfiles in .github/workflows/*.lock.yml as of 2026-09-09. Total size 45.9 MB (avg 153.4 KB, range 92.1 KB–245.4 KB). 0 malformed/skipped files.

File size distribution

Metric	Value
Count	299
Total	45,873,733 bytes (~43.7 MB)
Average	153,424 bytes
Min	92,150 bytes
Max	245,394 bytes

Trigger analysis

Trigger	Count
workflow_dispatch	291
schedule	242
pull_request	43
issues	5
issue_comment	3
workflow_call	3
deployment_status / workflow_run / discussion / discussion_comment / push / pull_request_review_comment	1 each

Top combinations: schedule+workflow_dispatch (209), workflow_dispatch only (38), pull_request+schedule+workflow_dispatch (29), pull_request+workflow_dispatch (9).

Cron frequency: 0 0 */2 * * dominates at 42 workflows (every-other-day cadence); the long tail is one-off custom schedules.

Safe outputs analysis

create_discussion_workflows: 92, discussion_category_detected: 92 (100% resolved — no fallback parsing needed, safe_outputs_config_missing: 0). This is case "detection succeeded for all"; not "no discussion-producing workflows configured."

Discussion categories: audits (79), announcements (5), artifacts (2), dev (2), research (2), general (1), daily-news (1).

Most common safe-output types (excluding the 4 always-present error/noop handlers): create_issue (146), create_discussion (92), add_comment (77), create_pull_request (64), push_repo_memory (36), add_labels (32), upload_asset (26), mentions (23).

Structural characteristics

Metric	Avg	Max
Jobs/workflow	7.35	14
Steps/workflow	144.15	205
Script (run:) steps/workflow	98.72	136

Timeout-minutes distribution across jobs: 10min (318), 45min (299 — one per agent job), 60min (292), 90min (3), 5min (2), 120min (2), 180min (1), 15min (1).

Permission patterns (agent job, not the always-empty top-level block)

permissions_unknown: 0 — resolved for all 299 workflows.

Scope	read	write	none
contents	299	0	0
issues	260	0	39
pull-requests	255	0	44
actions	114	0	185
discussions	52	0	247
security-events	14	0	285
id-token	0	2	297

Union across all jobs (includes the safe-output-writer job) shows every workflow (299/299) grants some write scope — expected, since safe-output application jobs need contents/issues write even though the agent job itself is read-only. Notably issues: write appears in 299/299 union permissions, and contents: write in 206/299.

Engine distribution (from gh-aw-metadata agent_id)

Engine	Count
copilot	123
codex	74
claude	56
pi	31
aider / opencode / goose	3 each
crush / cursor / deepseek-harness / gemini / kiro / pydantic-ai	1 each

engine_unknown: 0 — every lockfile resolved an engine.

Tool & MCP patterns

MCP servers by workflow count: safeoutputs (299, universal), github (175), agenticworkflows (44), serena (25), mcpscripts (12), tavily (5), sentry (3), plus single-digit usage of ast-grep, datadog, deepwiki, microsoftdocs, grafana, kreuzberg, mempalace, graft, agentdb, ruflo. mcp_fallback_used_count: 0 (all resolved via manifest).

Most-used individual tools: github:get_commit/get_file_contents/get_latest_release/etc. (167 each), safeoutputs:create_issue (146), safeoutputs:create_discussion (92).

Interesting findings

1. Engine mix shifted noticeably in 24h: codex dropped 94→74 (-21%) while pi rose 11→31 (+182%), suggesting an active migration wave between these two engines on 2026-09-08/09.
2. github MCP adoption also fell: 188→175 workflows (-7%) in the same window, tracking the codex→pi shift (pi workflows may bundle GitHub access differently).
3. Despite 299 workflows, 13 distinct engines are in play, but copilot+codex+claude alone cover 84% of all workflows.
4. 100% clean detection across engine, permissions, and discussion-category extraction — no unresolved lockfiles in any category, indicating the compiled lockfile format is stable and consistent across the fleet.
5. Every workflow's union permissions include a write scope, but only 2/299 request id-token: write — OIDC-based cloud auth is rare in this fleet.

Historical trends (vs 2026-09-08)

Metric	2026-09-08	2026-09-09	Δ
Lockfiles	299	299	0
Total bytes	46,081,246	45,873,733	-207,513 (-0.45%)
Avg steps	144.47	144.15	-0.32
codex engine	94	74	-20
pi engine	11	31	+20
github MCP server workflows	188	175	-13
github:get_me tool uses	155	143	-12
create_discussion workflows	92	92	0

Net engine churn is exactly 20 workflows moving between codex and pi, with the rest of the fleet stable (job/step/permission/discussion-category counts unchanged).

Recommendations

• Investigate the codex→pi engine migration (20 workflows) to confirm it's intentional and check whether MCP tool configs (esp. github) need re-adding for the migrated workflows, since github-server-workflow count dropped by 13 in the same window.
• actions: none on 185/299 agent jobs plus low id-token usage suggests most workflows don't need CI-introspection or OIDC — no action needed, just confirms least-privilege is generally followed.
• Consider trimming average step count (144, max 205) if any workflows show step bloat from repeated boilerplate — not evaluated here since per-workflow breakdown wasn't retained in the compact summary.

Methodology note

single-script compact JSON analysis

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by 📊 Lockfile Statistics Analysis Agent · claude · agent · 81.4 AIC · ⌖ 9.52 AIC · ⊞ 8.5K · ◷

• expires on Sep 10, 2026, 12:30 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Lockfile Statistics Analysis Agent.

A newer discussion is available at Discussion #60046.