[lockfile-stats] Lockfile Statistics — 2026-09-23 (299 workflows analyzed)

[github-actions[bot]]

Lockfile Statistics — 2026-09-23

299 lockfiles analyzed, 46.9 MB total, 0 skipped/malformed, 0 engine/permissions unknown.

File size distribution

Metric	Value
Total bytes	46,893,360
Avg size	156,834 B
Min size	91,998 B
Max size	250,347 B

Trigger analysis

Trigger	Count
workflow_dispatch	291
schedule	242
pull_request	43
issues	5
issue_comment	3
workflow_call	3

Top combination: schedule+workflow_dispatch (209), then workflow_dispatch only (38), pull_request+schedule+workflow_dispatch (29). Most common cron: 0 0 */2 * * (42 workflows, every 2 days).

Safe outputs analysis

92 workflows configure create_discussion (category detected for all 92 — 0 unresolved). Discussion categories: audits (79), announcements (5), artifacts (2), dev (2), research (2), general (1), daily-news (1).

Most common non-baseline safe outputs: create_issue (146), add_comment (77), create_pull_request (64), push_repo_memory (36), add_labels (32).

New today: jira_add_comment, jira_add_label, jira_update_issue (1 workflow each) — first appearance of these Jira safe-outputs alongside the existing jira_create_issue.

Structural characteristics

Metric	Avg	Max
Jobs/workflow	7.35	14
Steps/workflow	145.97	210
Scripts/workflow	100.92	141

Permission patterns (agent job)

Scope	read	write	none
contents	299	–	–
issues	260	–	39
pull-requests	255	–	44
actions	114	–	185
discussions	52	–	247
security-events	14	–	285

All 299 agent jobs are read-only on contents; no agent-job scope grants write. Across the union of all jobs per workflow, 299/299 grant at least one write scope (mostly contents write for repo-memory/PR pushes, and issues write for all 299).

Engine distribution

Engine	Count
copilot	124
codex	74
claude	56
pi	31
aider	3
goose	3
opencode	2
others (crush, cursor, deepseek-harness, gemini, kiro, pydantic-ai)	1 each

Notable model shift vs yesterday: copilot/auto rose from 18 → 30 (+12), while copilot/claude-sonnet-4.5 (8), claude-sonnet-4.5 (2), and copilot/claude-sonnet-4-5 (2) dropped out entirely — consistent with those 12 workflows being re-pinned/migrated to copilot/auto.

Tool & MCP patterns

Top MCP servers: safeoutputs (299), github (174), agenticworkflows (44), serena (25), mcpscripts (12), tavily (5), sentry (4). No fallback scraping needed (mcp_fallback_used_count: 0).

Interesting findings

1. Every one of the 299 lockfiles grants some write scope at the union-of-jobs level, even though the agent job itself is read-only everywhere — write actions are isolated into separate (safe-output) jobs.
2. id-token: write appears in only 2 agent jobs but 3 at the union level, and attestations/checks/packages writes are each ≤14 workflows — these are rare, likely CI/release-signing workflows.
3. Discussion-category detection is 100% reliable (92/92) — no fallback regex parsing was needed for any workflow.
4. Jira integration is emerging: 4 distinct Jira safe-output types now appear (create/update issue, add comment, add label), each still in a single workflow — likely one workflow under active development.
5. Total corpus size grew by ~106 KB (+0.23%) day-over-day with no change in lockfile count, indicating existing workflows grew slightly rather than new ones being added.

Historical trends (vs 2026-09-22)

Metric	2026-09-22	2026-09-23	Δ
Lockfiles	299	299	0
Total bytes	46,787,180	46,893,360	+106,180
Avg size	156,478.9	156,834.0	+355.1
create_discussion workflows	92	92	0
copilot/auto model count	18	30	+12

Recommendations

• Monitor the new Jira safe-output types (jira_add_comment, jira_add_label, jira_update_issue) as the integration matures — currently single-workflow, low blast radius.
• Given 100% of workflows already isolate write permissions away from the agent job, this pattern is a solid baseline to enforce for any new workflow additions.
• Track the copilot/auto migration — confirm the 12 workflows that dropped explicit claude-sonnet-4.5 pins intentionally moved to auto-routing rather than losing a pin unintentionally.

Methodology: single-script compact JSON analysis (cached analyzer reused from /tmp/gh-aw/cache-memory/scripts/lockfile_stats_v4.py).

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by 📊 Lockfile Statistics Analysis Agent · claude · agent · 80.6 AIC · ⌖ 7.59 AIC · ⊞ 8.7K · ◷

• expires on Sep 24, 2026, 12:29 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Lockfile Statistics Analysis Agent.

A newer discussion is available at Discussion #63249.