[lockfile-stats] Lockfile Statistics Analysis — 2026-09-24 (298 workflows)

[github-actions[bot]]

Executive Summary

Analyzed 298 .github/workflows/*.lock.yml files on 2026-09-24 via single-script compact JSON analysis. 0 malformed/skipped. Total size 46.80 MB, avg 157.0 KB/file (min 92.1 KB, max 250.7 KB).

File Size Distribution

Metric	Value
Count	298
Total	46,797,279 bytes (46.80 MB)
Average	157,037.8 bytes
Min	92,098 bytes
Max	250,672 bytes

Trigger Analysis

Trigger	Count	%
workflow_dispatch	290	97%
schedule	242	81%
pull_request	43	14%
issues	5	2%
issue_comment	3	1%
workflow_call	3	1%

Top combinations: schedule+workflow_dispatch (209), workflow_dispatch only (37), pull_request+schedule+workflow_dispatch (29).

Cron frequency detail (top entries)

Cron	Count
0 0 */2 * * (every 2 days, midnight)	42
7 5 * * *	3
all others	1–2 each

29 distinct cron expressions found across 242 scheduled workflows — most are unique per-workflow offsets, with the every-2-days cadence dominant.

workflow_dispatch present in 290/298 (97%) lockfiles.

Safe Outputs Analysis

Safe output type	Workflows
create_issue	145
create_discussion	92
add_comment	76
create_pull_request	64
push_repo_memory	36
add_labels	32
upload_asset	26
create_pull_request_review_comment	16
submit_pull_request_review	16
upload_artifact / create_check_run	14 each

(missing_data/missing_tool/noop/report_incomplete are near-universal scaffolding present in 292/298 and omitted from the ranking above as non-differentiating.)

Discussion categories (all 92 create_discussion workflows resolved a category — 0 unresolved):

Category	Count
audits	79
announcements	5
artifacts	2
dev	2
research	2
general	1
daily-news	1

Full safe-output type tail (long tail, ≤10 workflows each)

mentions (23), max_bot_mentions (8), close_issue/remove_labels (7 each), comment_memory/dispatch_workflow (6 each), update_pull_request/assign_to_agent (5 each), link_sub_issue/close_pull_request/send-slack-message (4 each), plus ~25 more types used by 1–3 workflows (jira_*, linear_create_issue, update_project, create_agent_session, etc.).

Structural Characteristics

Metric	Avg	Max
Jobs/workflow	7.35	14
Steps/workflow	146.03	210
Run-scripts/workflow	100.95	141

Timeout-minutes distribution (job-level): 45min → 298 workflows, 60min → 291, 10min → 353 (multiple jobs/workflow), 90min → 3, 120min → 2, 5min → 2, 15min/180min → 1 each.

Permission Patterns (agent job — primary scope)

Scope	read	write	none
contents	298	0	0
issues	259	0	39
pull-requests	254	0	44
actions	113	0	185
discussions	52	0	246
security-events	14	0	284
id-token	0	2	296
checks / pages / repository-projects / statuses / attestations	0	0	298

Union-of-all-jobs permissions (includes safe-output post-processing jobs)

Scope	read	write	none
contents	93	205	0
issues	0	298	0
pull-requests	116	145	37
actions	191	107	0
discussions	10	96	192
checks	0	14	284
security-events	12	3	283
id-token	0	3	295

All 298 workflows (100%) grant at least one write scope somewhere in their job graph, even though the agent job itself is read-only in the vast majority of cases — write access is concentrated in dedicated safe-output application jobs.

Engine Distribution

(resolved from gh-aw-metadata agent_id; 0 unknown)

Engine	Count	%
copilot	124	42%
codex	74	25%
claude	55	18%
pi	31	10%
aider / goose	3 each	1%
opencode	2	<1%
crush / cursor / deepseek-harness / gemini / kiro / pydantic-ai	1 each	<1%

Most common models: openai/gpt-5.3-codex (37), copilot/gpt-5.3-codex (33), copilot/auto (30), openai/gpt-5.4 (11), claude-sonnet-5 (6).

Tool & MCP Patterns

MCP server	Workflows
safeoutputs	298 (100%, universal)
github	174 (58%)
agenticworkflows	44
serena	25
mcpscripts	12
tavily	5
sentry / datadog / deepwiki / microsoftdocs / grafana	2 each
kreuzberg / mempalace / graft / agentdb / ruflo	1 each

No fallback (legacy comment-scraping) MCP detection was needed — all 298 lockfiles carried a parseable gh-aw-manifest.

Interesting Findings

1. safeoutputs MCP is universal (298/298) — confirms the safe-outputs pattern is now the mandatory write path for every agentic workflow in this repo, not just a convention.
2. copilot has overtaken codex and claude as the dominant engine (124 vs 74 vs 55), despite this being the gh-aw (GitHub Agentic Workflows) repo itself — suggests broad multi-engine dogfooding rather than a single default.
3. Every workflow (100%) grants write to some scope somewhere in its job graph, but the agent job itself is write-free in all 298 cases — all mutation is delegated to dedicated safe-output-application jobs, a clean least-privilege split.
4. issues: write appears in the union-of-jobs permissions for all 298 workflows regardless of whether the workflow uses create_issue (only 145 do) — likely a shared safe-outputs job template granting a broader default than each workflow strictly needs.
5. Discussion-category usage is heavily concentrated in audits (79/92, 86%), consistent with this very report's category — most create_discussion workflows in this repo are audit/reporting agents like this one.

Historical Trends (vs. 2026-09-23)

Metric	2026-09-23	2026-09-24	Δ
Lockfile count	299	298	−1
Total bytes	46,893,360	46,797,279	−96,081 (−0.2%)
Avg size	156,834.0	157,037.8	+203.8
workflow_dispatch count	291	290	−1
create_discussion workflows	92	92	flat
discussion_category_detected	92	92	flat (100% resolution both days)
union_any_write_count	299	298	−1 (tracks lockfile count)

One workflow was removed/renamed between runs (lockfile count and workflow_dispatch count both dropped by exactly 1), while average per-file size ticked up slightly — consistent with incremental feature growth in the remaining workflows.

Recommendations

• Confirm the removed lockfile was an intentional deletion/rename, not an accidental drop from .github/workflows/.
• Consider tightening the shared safe-outputs job template's default issues: write grant for workflows that never call create_issue/close_issue/update_issue (153/298 have no issue-mutating safe output yet inherit the write scope).
• No discussion-category or engine-detection gaps to address — resolution is 100% for both this run.

Methodology

Single-script compact JSON analysis: one Python script (lockfile_stats_v4.py, cached under /tmp/gh-aw/cache-memory/scripts/) parses all lockfiles once via yaml.safe_load, extracts engine identity from the gh-aw-metadata header comment, safe-output/discussion-category config from GH_AW_SAFE_OUTPUTS_CONFIG, and permissions from per-job permissions: blocks (the top-level permissions: {} carries no signal and was not used). Results written to a compact JSON summary and compared against the prior day's cached summary for trend deltas.

References:

• Workflow run: §36054602981

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by 📊 Lockfile Statistics Analysis Agent · claude · agent · 67.3 AIC · ⌖ 7.85 AIC · ⊞ 8.7K · ◷

• expires on Sep 25, 2026, 12:30 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Lockfile Statistics Analysis Agent.

A newer discussion is available at Discussion #63508.