[lockfile-stats] Lockfile Statistics Analysis — 2026-09-27 (298 lockfiles, flat vs prior day)

[github-actions[bot]]

Lockfile Statistics — 2026-09-27

Analysis of all .github/workflows/*.lock.yml compiled workflow files in this repo.

Overview: 298 lockfiles, ~44.7 MB total, avg 153.5 KB each. All parsed cleanly (0 skipped). Fleet composition and permission patterns are nearly unchanged from the prior snapshot (2026-09-26).

Key metrics

Metric	Value
Lockfiles	298 (0 skipped/malformed)
Total size	46,843,837 bytes (~44.7 MB)
Avg / min / max size	157,194 / 92,961 / 250,691 bytes
workflow_dispatch enabled	290 / 298 (97%)
schedule enabled	242 / 298 (81%)
Engines resolved	298 / 298 (0 unknown)
Job permissions resolved	298 / 298 (0 unknown)
Workflows with create_discussion	92 (100% category-detected)
Safe-outputs config found	298 / 298

File size distribution

Avg 157.2 KB, min 93.0 KB, max 250.7 KB — a fairly tight spread (~2.7x max/min), consistent with a shared compiled-workflow scaffold plus per-workflow logic.

Trigger analysis

Trigger counts and top combinations

Trigger	Count
workflow_dispatch	290
schedule	242
pull_request	43
issues	5
issue_comment	3
workflow_call	3
deployment_status / workflow_run / discussion / discussion_comment / push / pull_request_review_comment	1 each

Top combinations: schedule+workflow_dispatch (209, 70%), workflow_dispatch only (37, 12%), pull_request+schedule+workflow_dispatch (29, 10%), pull_request+workflow_dispatch (9).

Cron cadence is dominated by one pattern: 0 0 */2 * * (every 2 days) appears 42 times (17% of all scheduled workflows); the remaining ~200 scheduled workflows spread across dozens of distinct, largely unique cron expressions.

Safe outputs analysis

Safe-output type frequency (top entries)

Near-universal scaffolding: missing_data, missing_tool, noop, report_incomplete, create_report_incomplete_issue each appear in 292/298 workflows (98%) — a de facto standard safe-output baseline across the fleet (this workflow included).

Feature safe outputs: create_issue 145 (49%), create_discussion 92 (31%), add_comment 76 (26%), create_pull_request 64 (21%), push_repo_memory 36, add_labels 32, upload_asset 26, then a long tail down to single-use integrations (Jira, Linear, Slack).

Discussion categories (92 workflows, 100% detected, 0 unresolved, 0 fallback-parsed): audits 79 (86%), announcements 5, artifacts 2, dev 2, research 2, general 1, daily-news 1.

Structural characteristics

	Avg	Max
Jobs / workflow	7.35	14
Steps / workflow	146.0	210
Script steps / workflow	100.9	141

Timeout minutes across all jobs: 10min (353 jobs), 45min (298), 60min (291), 90min (3), 5min (2), 120min (2), 180min (1), 15min (1) — the 45/60/10-minute triad is essentially universal per workflow.

Permission patterns

(derived from jobs.agent.permissions and per-job union — the top-level permissions: {} carries no signal and was not used)

Agent job (primary, mirrors frontmatter) — contents: read 100%; issues read 87% / none 13%; pull-requests read 85% / none 15%; actions read 38% / none 62%; discussions read 17% / none 83%; id-token: write only 2 workflows; all other scopes (checks, pages, statuses, repository-projects, attestations) are none in essentially all workflows.

Union across all jobs — issues: write in 298/298 (100%) and some write scope present in 298/298 workflows, even though only 145 configure create_issue — write access is provisioned defensively at the job-graph level, not only where a matching safe output is configured. contents is write in 205 (69%) / read in 93 (31%); discussions: write in 96 (roughly tracking the 92 create_discussion + a few close_discussion configs).

Engine distribution

(from gh-aw-metadata agent_id, 0 unresolved)

copilot 123 (41%), codex 74 (25%), claude 56 (19%), pi 31 (10%), aider 3, goose 3, opencode 2, crush/cursor/deepseek-harness/gemini/kiro/pydantic-ai 1 each — a genuinely multi-engine fleet rather than one engine dominating.

Notable model field: 3 workflows resolve their model via a templated expression (${{ needs.activation.outputs.model_size }}) rather than a static model id.

Tool & MCP patterns

safeoutputs MCP server: 298/298 (100%, universal). github: 174 (58%). agenticworkflows: 44 (15%). serena: 25 (8%). Long tail: mcpscripts, tavily, sentry, ast-grep, datadog, deepwiki, microsoftdocs, grafana, and single-use servers (kreuzberg, mempalace, graft, agentdb, ruflo). 0 workflows required fallback (non-manifest) tool detection.

Interesting findings

1. Defensive write permissions: every workflow (298/298) grants issues: write and some write scope at the job-graph level, even though only 145 configure create_issue as a safe output — permissions are provisioned by the safe-output application layer uniformly, not per-feature.
2. Multi-engine fleet: copilot leads at only 41%; codex (25%) and claude (19%) are both substantial, not fringe.
3. Cron concentration: a single cadence (0 0 */2 * *) accounts for 17% of all scheduled workflows; the rest are individually tuned.
4. Discussion category near-monoculture: 86% of create_discussion workflows (79/92) post to audits, same as this report.
5. Near-universal safe-output baseline: 98% of workflows carry the same five safe-output types (missing_data/missing_tool/noop/report_incomplete/create_report_incomplete_issue), indicating a shared compiled template rather than per-workflow opt-in.

Historical trends

Compared to the prior snapshot (2026-09-26): lockfile count unchanged (298 → 298); total size grew marginally (+6,830 bytes, +0.01%, avg size +22.9 bytes/file). All trigger, safe-output, engine, permission, timeout, and MCP distributions are identical byte-for-byte to the prior day — no structural change, only a trivial content edit in one or two lockfiles.

Recommendations

• Given issues: write is granted universally regardless of whether create_issue is configured, consider scoping the safe-output-apply job's permissions to only the safe outputs actually enabled per workflow, to reduce blast radius.
• The audits discussion category is heavily concentrated (86%); if category diversity is desired, review whether other categories are underused by convention or by omission.
• The templated model expression (${{ needs.activation.outputs.model_size }}) in 3 workflows is worth spot-checking to confirm it resolves to a valid, current model id at runtime.

Methodology: single-script compact JSON analysis (cached analyzer, reused from prior run; self-checks passed: 0 skipped lockfiles, 0 engine-unknown, 0 permissions-unknown, 92/92 discussion categories detected, 0 safe-outputs-config-missing).

References:

• §36347733446

Generated by 📊 Lockfile Statistics Analysis Agent · claude · agent · 69.6 AIC · ⌖ 7.8 AIC · ⊞ 8.7K · ◷

• expires on Sep 28, 2026, 12:27 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Lockfile Statistics Analysis Agent.

A newer discussion is available at Discussion #64080.