[lockfile-stats] Lockfile Statistics Report — 2026-09-22

[github-actions[bot]]

Analysis of 299 compiled .github/workflows/*.lock.yml files in github/gh-aw, generated via single-script compact JSON analysis. 0 lockfiles skipped as malformed.

Executive summary

Metric	Value
Lockfiles analyzed	299
Total size	46,787,180 bytes (~44.6 MB)
Avg / min / max size	156,479 / 91,998 / 250,347 bytes
Workflows with workflow_dispatch	291 (97%)
Workflows with schedule	242 (81%)
create_discussion workflows	92
Engines resolved	299/299 (0 unknown)
Permissions resolved	299/299 (0 unknown)

File size distribution

• Range spans 91,998 – 250,347 bytes, a 2.7x spread between smallest and largest lockfile — likely driven by MCP tool/server allowlists and step count rather than trigger complexity.
• Average size (156 KB) sits closer to the low end of the range, suggesting a long tail of a few unusually large workflows (max 250 KB) rather than a uniform distribution.

Trigger analysis

Top individual triggers:

Trigger	Count
workflow_dispatch	291
schedule	242
pull_request	43
issues	5
issue_comment	3
workflow_call	3
discussion / discussion_comment / push / workflow_run / deployment_status / pull_request_review_comment	1 each

Top trigger combinations:

Combination	Count
schedule + workflow_dispatch	209
workflow_dispatch only	38
pull_request + schedule + workflow_dispatch	29
pull_request + workflow_dispatch	9
pull_request only	3

Schedule cadence: the dominant cron is 0 0 */2 * * (every 2 days) at 42 workflows — far ahead of any other single cron pattern (next highest: 3 occurrences). Most other crons are unique per-workflow daily/weekday schedules.

Safe outputs analysis

Every workflow ships the standard safety trio (missing_data, missing_tool, noop, report_incomplete, create_report_incomplete_issue at 293/299 — 6 workflows lack these, worth spot-checking).

Top domain-specific safe outputs:

Safe output	Workflows
create_issue	146
create_discussion	92
add_comment	77
create_pull_request	64
push_repo_memory	36
add_labels	32
upload_asset	26

Discussion categories (92 create_discussion workflows, 92/92 detected — 100%, no unresolved cases):

Category	Count
audits	79
announcements	5
artifacts	2
dev	2
research	2
general	1
daily-news	1

Detection status: not a failure case — create_discussion_workflows (92) and discussion_category_detected (92) match exactly, with 0 fallback-regex parses needed. safe_outputs_config_missing = 0.

Structural characteristics

	Avg	Max
Jobs per workflow	7.35	14
Steps per workflow	145.97	210
Script (run:) steps per workflow	100.92	141

Permission patterns

Based on jobs.agent.permissions (the primary per-workflow scope, mirroring frontmatter — not the always-empty top-level permissions: {}):

Scope	read	write	none
contents	299	0	0
issues	260	0	39
pull-requests	255	0	44
actions	114	0	185
discussions	52	0	247
security-events	14	0	285
id-token	0	2	297

The agent job itself never holds write on any scope except id-token (2 workflows) — consistent with the safe-outputs pattern where writes happen via a separate downstream job.

Union across all jobs (any job in the workflow, e.g. the safe-output-processing job) tells the real write story: all 299 workflows grant write on issues somewhere in the job graph, 206 grant contents: write, 146 grant pull-requests: write, and 96 grant discussions: write. All 299 workflows have at least one job with a write scope (union_any_write_count: 299).

Engine distribution

Engine	Count	Share
copilot	124	41%
codex	74	25%
claude	56	19%
pi	31	10%
aider	3	1%
goose	3	1%
opencode	2	<1%
crush / cursor / deepseek-harness / gemini / kiro / pydantic-ai	1 each	<1%

0 lockfiles had an unresolved engine (all identified via gh-aw-metadata agent_id).

Tool & MCP patterns

MCP servers in use:

Server	Workflows
safeoutputs	299
github	174
agenticworkflows	44
serena	25
mcpscripts	12
tavily	5
sentry	4

Most-used individual tools: github:get_commit, get_file_contents, get_latest_release, get_release_by_tag, get_tag, list_branches, list_commits, list_releases, list_starred_repositories, list_tags, search_code, search_repositories are tied at 166 workflows each (likely granted as a bundled read-only toolset). All MCP data came from the gh-aw-manifest comment — 0 workflows required the legacy fallback parser.

Interesting findings

1. Near-universal automation posture: 97% of workflows are manually triggerable (workflow_dispatch) and 81% run on a schedule — this repo's workflows are overwhelmingly autonomous/scheduled rather than purely event-reactive.
2. audits dominates discussion categories (79 of 92, 86%) — this very report is one of them, suggesting the audits category is the primary reporting channel for automated analysis workflows.
3. Permission separation is consistent: the agent job is read-only almost everywhere (max write exposure is id-token in 2 workflows), while writes are consistently delegated to a separate job — a clean least-privilege pattern held across the entire fleet.
4. Engine mix has shifted toward Copilot: copilot is now the plurality engine (124/299, 41%), ahead of codex (74) and claude (56).
5. Every workflow reuses the same read-only GitHub toolset: the 166-count tie across 12 distinct github:* tools strongly suggests a shared/bundled tool-group definition rather than per-workflow hand-picking.

Historical trends (vs. 2026-09-21)

Metric	2026-09-21	2026-09-22	Δ
Lockfile count	299	299	0
Total bytes	46,335,061	46,787,180	+452,119 (+1.0%)
copilot engine	123	124	+1
opencode engine	3	2	−1
codex / claude / pi engines	74 / 56 / 31	74 / 56 / 31	0

Net effect: one workflow appears to have switched engine from opencode to copilot (or an equivalent net change), alongside modest growth in average lockfile size — consistent with incremental workflow edits rather than a bulk change.

Recommendations

• Investigate the 6 workflows missing the standard noop/missing_tool/missing_data safety trio (293 vs. 299 lockfiles) to confirm this is intentional.
• Consider whether the 44 workflows without pull-requests permission and 185 without actions permission need it, given how many downstream jobs already carry write there — tightening/loosening should be a deliberate, not incidental, choice.
• Given audits category already holds 79 discussions, consider whether it needs sub-categorization as the audit workflow count grows.

Methodology: single-script compact JSON analysis (analyzer cached at /tmp/gh-aw/cache-memory/scripts/lockfile_stats_v4.py, summary written to compact JSON, historical comparison against 2026-09-21).

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by 📊 Lockfile Statistics Analysis Agent · claude · agent · 69.7 AIC · ⌖ 7.4 AIC · ⊞ 8.7K · ◷

• expires on Sep 23, 2026, 12:29 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Lockfile Statistics Analysis Agent.

A newer discussion is available at Discussion #63025.