[lockfile-stats] Lockfile Statistics — 2026-09-14

[github-actions[bot]]

Analysis of .github/workflows/*.lock.yml in github/gh-aw — 299 compiled lockfiles, 46,336,082 bytes total (avg 154,970 B, min 91,533 B, max 247,974 B). 0 malformed/skipped files.

File size distribution

Metric	Value
Count	299
Total	44.2 MB
Avg	151.3 KB
Min	89.4 KB
Max	242.2 KB

Trigger analysis

Top triggers: workflow_dispatch (291), schedule (242), pull_request (43), issues (5), issue_comment/workflow_call (3 each).

Most common combinations: schedule+workflow_dispatch (209), workflow_dispatch only (38), pull_request+schedule+workflow_dispatch (29), pull_request+workflow_dispatch (9).

Cron cadence: 42 workflows share 0 0 */2 * * (every 2 days); the remainder are mostly unique daily/weekly schedules.

Safe outputs analysis

• create_issue: 146, create_discussion: 92, add_comment: 77, create_pull_request: 64, push_repo_memory: 36, add_labels: 32
• Discussion-producing workflows: 92/92 resolved a category (100% detection, 0 fallback-parsed, 0 config-missing)
• Discussion categories: audits (79), announcements (5), artifacts/dev/research (2 each), general/daily-news (1 each)

Structural characteristics

Metric	Avg	Max
Jobs/workflow	7.35	14
Steps/workflow	145.9	208
Script steps/workflow	101.8	140

Timeout distribution (job-level, minutes): 10min appears 318×, 45min 299×, 60min 292× — most workflows layer multiple timeout tiers across jobs.

Permission patterns (agent job)

contents: read is universal (299/299). issues/pull-requests read access ~260/255 workflows; actions: read in 114; discussions: read in 52 (tracks with the 92 discussion-producers, since some also write via a separate reporting job). Only 2 workflows grant id-token: write at the agent-job level.

Unioned across all jobs (agent + write-back jobs), 299/299 workflows grant at least one write scope somewhere in the workflow — expected, since safe-output write-back jobs run with elevated, scoped permissions separate from the read-only agent job.

Engine distribution

Engine	Count
copilot	123
codex	74
claude	56
pi	31
aider/opencode/goose	3 each
crush/cursor/deepseek-harness/gemini/kiro/pydantic-ai	1 each

0 unresolved (engine_unknown).

Tool & MCP patterns

MCP servers by workflow count: safeoutputs (299, universal), github (175), agenticworkflows (44), serena (25), mcpscripts (12), plus long tail (tavily, sentry, ast-grep, datadog, deepwiki, microsoftdocs, grafana, kreuzberg, mempalace, graft, agentdb, ruflo).

Most-used individual tools: safeoutputs:missing_data/missing_tool/noop (293 each — near-universal safety scaffolding), github:get_commit/get_file_contents (167), safeoutputs:create_issue (146), github:get_me (143).

Interesting findings

1. Nearly every workflow (293/299) ships the missing_data/missing_tool/noop safe-output triad — this has become a de facto standard scaffold, not an occasional pattern.
2. copilot is now the plurality engine (123/299, 41%) ahead of codex (74) and claude (56) — a notable shift toward Copilot-backed agentic workflows in this repo.
3. Every discussion-producing workflow resolved its category cleanly via GH_AW_SAFE_OUTPUTS_CONFIG — no fallback regex parsing was needed, indicating consistent lockfile compilation.
4. Despite 299 workflows, the union of all jobs' permissions grants some write scope 100% of the time, while the agent job itself stays read-only in the overwhelming majority — reflecting gh-aw's split between a sandboxed read-only agent job and a narrowly-scoped write-back job.
5. id-token: write (OIDC) appears in only 2/299 workflows at the agent-job level, suggesting minimal reliance on OIDC-based cloud auth across the fleet.

Historical trends (vs. 2026-09-13)

Metric	2026-09-13	2026-09-14	Δ
Lockfile count	299	299	0
Total bytes	46,367,016	46,336,082	−30,934
create_discussion workflows	92	92	0
Engine distribution	identical	identical	—

No structural shifts day-over-day; the byte-count dip reflects minor lockfile regeneration/formatting, not new workflows.

Recommendations

• Consider consolidating the near-universal missing_data/missing_tool/noop/report_incomplete scaffold into a shared compiled fragment if not already, given its near-100% adoption.
• With copilot now the plurality engine, ensure engine-specific documentation/tooling parity keeps pace with claude/codex.
• The long tail of single-use MCP servers (kreuzberg, mempalace, graft, agentdb, ruflo, etc.) may be worth a periodic audit for staleness.

Methodology: single-script compact JSON analysis (lockfile_stats_v4.py, cached in /tmp/gh-aw/cache-memory/scripts/).

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by 📊 Lockfile Statistics Analysis Agent · claude · agent · 75 AIC · ⌖ 7.63 AIC · ⊞ 8.5K · ◷

• expires on Sep 15, 2026, 12:29 PM UTC-08:00

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-09-15T20:29:04.630Z.

Closed by Workflow