[lockfile-stats] Lockfile Statistics — 2026-09-28

[github-actions[bot]]

298 compiled workflow lockfiles analyzed, 46.85 MB total (0 malformed, 0 unresolved engine/permission/discussion-category detections).

Metric	Value
Lockfiles	298
Total size	46,845,881 bytes (44.68 MB)
Avg / min / max size	157,201 / 92,961 / 250,698 bytes
Avg jobs / max	7.35 / 14
Avg steps / max	146.03 / 210
Avg inline scripts / max	100.94 / 141

File size distribution

Sizes cluster tightly around the ~157 KB average (min 93 KB, max 251 KB) — a ~2.7x spread, consistent with most workflows sharing the same compiled scaffolding (safe-outputs handlers, MCP wiring) with variable amounts of custom prompt/tool config layered on top.

Trigger analysis

Trigger	Count
workflow_dispatch	290
schedule	242
pull_request	43
issues	5
issue_comment	3
workflow_call	3
deployment_status / workflow_run / discussion / discussion_comment / push / pull_request_review_comment	1 each

Top trigger combinations: schedule+workflow_dispatch (209), workflow_dispatch only (37), pull_request+schedule+workflow_dispatch (29), pull_request+workflow_dispatch (9).

Cron cadence: the dominant schedule is 0 0 */2 * * (every 2 days) at 42 workflows; the remaining ~30 distinct cron expressions each appear 1-3 times, indicating most scheduled workflows are hand-tuned to avoid clustering at a single time.

Safe outputs analysis

Every workflow ships the baseline safe-output tool set (missing_data, missing_tool, noop, report_incomplete, create_report_incomplete_issue — 292/298). Beyond the baseline:

Safe output	Count	Safe output	Count
create_issue	145	create_pull_request	64
create_discussion	92	add_comment	76
push_repo_memory	36	add_labels	32
upload_asset	26	mentions	23
create_pull_request_review_comment / submit_pull_request_review	16 each	upload_artifact / create_check_run	14 each

Discussion categories (92 workflows configure create_discussion, all 92 resolved — 0 unresolved): audits dominates at 79, followed by announcements (5), artifacts/dev/research (2 each), general/daily-news (1 each). This audit itself lands in audits.

Structural characteristics

• Jobs per workflow: avg 7.35, max 14
• Steps per workflow: avg 146, max 210
• Inline scripts per workflow: avg ~101, max 141 — the bulk of each workflow's step count is generated script glue rather than uses: actions
• Timeouts: 10 min appears 353 times (per-job granularity, so more than one 10-min job per workflow is common), 45 min on all 298 (likely the agent job default), 60 min on 291

Permission patterns (agent job, not top-level)

Agent jobs are read-mostly: contents: read universally (298/298), issues: read (259) / none (39), pull-requests: read (254) / none (44), discussions: read only 52 (246 none). No agent job carries write permissions directly.

The union across all jobs in each workflow tells a different story — every single workflow (298/298) grants at least one write scope somewhere in its job graph, most commonly issues: write (all 298) and contents: write (205). This is expected: safe-output "apply" jobs (separate from the sandboxed agent job) need write access to actually create issues/PRs/discussions, while the agent job itself stays read-only — the intended security boundary in gh-aw's design.

Engine distribution

Engine	Count	Engine	Count
copilot	123	pi	31
codex	74	aider / goose	3 each
claude	56	opencode	2
—	—	crush / cursor / deepseek-harness / gemini / kiro / pydantic-ai	1 each

Copilot leads at 41%, codex 25%, claude 19%. All 298 engines resolved (0 unknown).

Models: openai/gpt-5.3-codex (37) and copilot/gpt-5.3-codex (33) are the top two explicit picks; copilot/auto (30) is the most common auto-select. A handful of workflows (3) parameterize model choice via ${{ needs.activation.outputs.model_size }}.

Tool & MCP patterns

Every workflow uses the safeoutputs MCP server (298/298). github MCP is used by 174 workflows, agenticworkflows by 44, serena by 25. Long tail: mcpscripts (12), tavily (5), sentry (4), plus single-digit usage of ast-grep, datadog, deepwiki, microsoftdocs, grafana, kreuzberg, mempalace, graft, agentdb, ruflo.

Most-called individual tools: safeoutputs:missing_data/missing_tool/noop (292 each, baseline), github:get_commit/get_file_contents/get_latest_release family (166 each), safeoutputs:create_issue (145), github:get_me (142).

Interesting findings

1. Zero unresolved detections — engine, permissions, and discussion-category extraction all succeeded for 100% of the 298 lockfiles this run.
2. Read/write split by design: agent jobs are uniformly read-scoped while 100% of workflows still show write capability somewhere in their job graph — confirming the sandboxed-agent + privileged-apply-job pattern is applied consistently repo-wide.
3. Copilot is now the plurality engine (41%, 123 workflows), ahead of codex (25%) and claude (19%) — notable in an "AI credits" audit context given engine choice drives cost/behavior differences.
4. Discussion output is a first-class citizen: 92/298 workflows (31%) publish discussions, and audits is by far the dominant category (79 of 92), suggesting most discussion-producing workflows are themselves reporting/audit agents like this one.
5. Scripts dominate step counts: ~101 of ~146 average steps per workflow are inline scripts rather than marketplace actions — a heavy reliance on generated glue code over reusable actions.

Historical trends (vs 2026-09-27)

Lockfile count unchanged (298 → 298). Total size grew marginally: +2,044 bytes (46,843,837 → 46,845,881), consistent with minor content edits rather than structural changes (no new/removed workflows, trigger/engine/permission distributions identical day-over-day).

Recommendations

• Consider consolidating the ~30 distinct cron expressions scheduled workflows use — many differ by only a few minutes and could share slots without meaningfully changing execution cadence, simplifying scheduling review.
• With engine choice this fragmented (13 distinct engines), periodically audit whether niche engines (aider, goose, opencode, crush, cursor, deepseek-harness, gemini, kiro, pydantic-ai — each ≤3 workflows) are still the right fit or could consolidate onto the three dominant engines for easier maintenance.
• Given inline scripts outnumber other step types roughly 2:1, watch for opportunities to extract common script patterns into shared reusable actions to reduce the ~146-step average and lockfile size.

Methodology: single-script compact JSON analysis (cached analyzer at /tmp/gh-aw/cache-memory/scripts/lockfile_stats_v4.py, reused from a prior run; see <safe-output-tools> history in /tmp/gh-aw/cache-memory/history/).

Generated by 📊 Lockfile Statistics Analysis Agent · claude · agent · 84.9 AIC · ⌖ 7.8 AIC · ⊞ 8.7K · ◷

• expires on Sep 29, 2026, 12:30 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Lockfile Statistics Analysis Agent.

A newer discussion is available at Discussion #64341.