[lockfile-stats] Lockfile Fleet Statistics — 2026-09-26 (298 workflows)

[github-actions[bot]]

Lockfile Fleet Statistics — 2026-09-26

Analysis of all 298 compiled .github/workflows/*.lock.yml files in github/gh-aw. Single-script compact JSON analysis — see Methodology below.

Snapshot: 298 lockfiles · 0 malformed · 44.7 MB total · avg 153.5 KB/file

File size distribution

Metric	Value
Count	298
Total	46,837,007 bytes (44.68 MB)
Average	157,171 bytes
Min	92,961 bytes
Max	250,691 bytes

Trigger analysis

Trigger	Workflows
workflow_dispatch	290 (97%)
schedule	242 (81%)
pull_request	43 (14%)
issues	5
issue_comment	3
workflow_call	3
discussion / discussion_comment / push / workflow_run / deployment_status / pull_request_review_comment	1 each

Dominant combination: schedule + workflow_dispatch (209 workflows, 70%), followed by workflow_dispatch-only (37) and pull_request+schedule+workflow_dispatch (29).

Cron cadence: the most common schedule is 0 0 */2 * * (every 2 days), shared by 42 workflows — a notable clustering point. The remaining ~200 scheduled workflows are spread across distinct daily/weekly times (mostly count 1-2 each), so cron load is otherwise well distributed.

Safe outputs analysis

98% of workflows (292/298) ship the full built-in guardrail set: noop, missing_data, missing_tool, report_incomplete (+create_report_incomplete_issue). The remaining 6 lockfiles lack this set — worth a quick check that they're intentionally minimal.

Most common actionable safe outputs:

Type	Count
create_issue	145
create_discussion	92
add_comment	76
create_pull_request	64
push_repo_memory	36
add_labels	32
upload_asset	26

Discussion categories (92 create_discussion workflows, 100% category-resolved, 0 unresolved):

Category	Count
audits	79 (86%)
announcements	5
artifacts	2
dev	2
research	2
general	1
daily-news	1

Structural characteristics

Metric	Avg	Max
Jobs/workflow	7.35	14
Steps/workflow	146.0	210
Scripts/workflow	100.9	141

Timeout minutes across jobs: 10min (353 jobs), 45min (298), 60min (291), with a long tail at 90/120/180/15 min (≤3 each).

Permission patterns

Agent-job permissions vs. union-of-all-jobs permissions (click to expand)

Agent job (the reasoning/LLM job) is almost universally read-only:

Scope	read	write	none
contents	298	0	0
issues	259	0	39
pull-requests	254	0	44
actions	113	0	185
discussions	52	0	246
id-token	0	2	296
security-events	14	0	284

All other scopes (checks, deployments, packages, pages, repository-projects, statuses, attestations) are none for essentially every agent job.

Union across all jobs in a workflow (i.e., including the dedicated safe-output writer jobs) looks very different:

Scope	write	read	none
issues	298 (100%)	0	0
contents	205	93	0
pull-requests	145	116	37
actions	107	191	0
discussions	96	10	192

298/298 workflows (100%) grant write on at least one scope somewhere in the workflow — but never in the agent job itself.

Engine distribution

Engine	Count	Share
copilot	123	41%
codex	74	25%
claude	56	19%
pi	31	10%
aider / goose	3 each
opencode	2
crush / cursor / deepseek-harness / gemini / kiro / pydantic-ai	1 each

engine_unknown: 0 — every lockfile resolved an engine via gh-aw-metadata.

Top models: openai/gpt-5.3-codex (37), copilot/gpt-5.3-codex (33), copilot/auto (30), openai/gpt-5.4 (11), claude-sonnet-5 (6).

Tool & MCP patterns

MCP server	Workflows
safeoutputs	298 (100%)
github	174 (58%)
agenticworkflows	44
serena	25
mcpscripts	12
tavily / sentry / others	≤5 each

No lockfiles required fallback (regex) MCP detection — all resolved from the gh-aw-manifest header.

Interesting findings

1. Read/write separation is universal and total. Every agent job is read-only on contents (298/298) and grants no direct write scope beyond 2 workflows' id-token. Yet 100% of workflows have write access somewhere in the job graph — confirming the safe-outputs pattern (dedicated writer job) is applied without exception across the fleet.
2. Copilot leads engine share (41%), ahead of codex (25%) and claude (19%), inside gh-aw's own workflow fleet.
3. audits is the dominant discussion category (79/92, 86%) — this very report follows the fleet's most common discussion pattern.
4. Schedule clustering: 42 workflows (14% of all lockfiles) share the identical 0 0 */2 * * cron — a single burst point every 2 days at midnight UTC.
5. Corpus is fully clean: 0 malformed lockfiles, 0 engine_unknown, 0 permissions_unknown, 0 safe_outputs_config_missing, 0 unresolved discussion categories.

Historical trends

Compared to the prior snapshot (2026-09-25, also 298 lockfiles):

Metric	2026-09-25	2026-09-26	Δ
Total bytes	46,800,520	46,837,007	+36,487 (+0.08%)
Avg size	157,048.7	157,171.2	+122.5
Min size	92,098	92,961	+863
Max size	250,672	250,691	+19
Engine: copilot	124	123	-1
Engine: claude	55	56	+1

All trigger, safe-output, discussion-category, and permission distributions are unchanged day-over-day. The only structural movement is one workflow migrating its engine from copilot to claude, alongside routine lockfile regeneration (small size deltas from compiler/version bumps).

Recommendations

• Audit the 6 lockfiles missing the standard noop/missing_data/missing_tool/report_incomplete guardrail set — confirm they're intentionally minimal rather than an oversight.
• Consider staggering the 42 workflows sharing the 0 0 */2 * * cron to reduce simultaneous runner load every two days.
• The read-only-agent/write-only-safe-output-job separation is a strong security invariant across 100% of the fleet — worth preserving as new workflows are added, and worth a lint/CI check if one doesn't already exist.

Methodology: single-script compact JSON analysis (cached analyzer lockfile_stats_v4.py, re-run this session; prior-day comparison from /tmp/gh-aw/cache-memory/history/).

References:

• §36269202158

Generated by 📊 Lockfile Statistics Analysis Agent · claude · agent · 73.5 AIC · ⌖ 7.74 AIC · ⊞ 8.7K · ◷

• expires on Sep 27, 2026, 12:27 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Lockfile Statistics Analysis Agent.

A newer discussion is available at Discussion #63877.