[lockfile-stats] Lockfile Statistics Analysis — 2026-10-01 (301 workflows)

[github-actions[bot]]

Executive summary

• 301 lockfiles compiled under .github/workflows/*.lock.yml as of 2026-10-01 (+1 vs 2026-09-29 snapshot, 300 lockfiles)
• Total size 47,386,965 bytes (~45.2 MB), avg 157,431.8 B, min 92,950 B, max 252,885 B
• 0 malformed/skipped lockfiles
• Methodology: single-script compact JSON analysis (lockfile_stats_v4.py, reused from cache)

File size distribution

Metric	Value	Δ vs 2026-09-29
Count	301	+1
Total bytes	47,386,965	+297,473 (+0.63%)
Avg	157,431.8	+466.8
Min	92,950	+~-11 (prior 92,961)
Max	252,885	+2,187 (prior 250,698)

Trigger analysis

Top triggers (count / % of 301): workflow_dispatch 293 (97.3%), schedule 245 (81.4%), pull_request 43 (14.3%), issues 5, issue_comment 3, workflow_call 3; singletons: deployment_status, workflow_run, discussion, discussion_comment, push, pull_request_review_comment.

Top trigger combinations: schedule+workflow_dispatch 212 (70.4%), workflow_dispatch only 37, pull_request+schedule+workflow_dispatch 29, pull_request+workflow_dispatch 9.

Most common cron: 0 0 */2 * * (every 2 days) — 44 workflows (was 43).

Full cron frequency table

Cron	Count
0 0 */2 * *	44
7 5 * * *	3
49 14 * * 1-5	2
23 11 * * *	2
38 3 * * *	2
9 3 * * *	2
41 4 * * *	2
26 5 * * *	2
37 5 * * *	2
40 3 * * *	2
(19 further distinct crons)	1 each

Safe outputs analysis

create_discussion_workflows = 92, discussion_category_detected = 92 (100% resolved, 0 fallback-regex parses, safe_outputs_config_missing = 0) — safe-output config extraction is fully reliable on this lockfile set.

Top safe-output types: create_issue 147 (48.8%), create_discussion 92 (30.6%), add_comment 76 (25.2%), create_pull_request 65 (21.6%), push_repo_memory 35, add_labels 32, upload_asset 26, mentions 23, create_pull_request_review_comment/submit_pull_request_review 16 each.

Discussion categories (of 92 discussion-creating workflows): audits 79 (85.9%), announcements 5, artifacts 2, dev 2, research 2, general 1, daily-news 1.

Structural characteristics

	Avg	Max
Jobs/workflow	7.36	14
Steps/workflow	146.32	212
Scripts/workflow	101.04	142

Permission patterns (agent job, not top-level permissions: {})

permissions_unknown = 0 (resolved for all 301).

Agent job (mirrors frontmatter) — notable scopes:

Scope	read	write	none
contents	301	0	0
issues	260	0	41
pull-requests	255	0	46
actions	114	0	187
discussions	52	0	249
security-events	14	0	287
id-token	0	2	299

Every agent job runs with zero write scopes on contents — all mutation is pushed into downstream safe-output jobs.

Union across all jobs (where effective writes live):

Scope	write	read	none
issues	301	0	0
contents	208	93	0
pull-requests	146	116	39
actions	110	191	0
discussions	96	10	195
checks	14	0	287

union_any_write_workflows = 301 — every workflow grants a write scope somewhere (expected: safe-output infra jobs need it).

Engine distribution (from gh-aw-metadata agent_id)

engine_unknown = 0 (fully resolved).

Engine	Count	%
copilot	126	41.9%
codex	74	24.6%
claude	56	18.6%
pi	31	10.3%
aider	3	1.0%
goose	3	1.0%
opencode	2	0.7%
crush/cursor/deepseek-harness/gemini/kiro/pydantic-ai	1 each	0.3%

Top models: openai/gpt-5.3-codex 37, copilot/gpt-5.3-codex 35, copilot/auto 29, openai/gpt-5.4 11, claude-sonnet-5 6.

Tool & MCP patterns

mcp_fallback_used_count = 0 — all servers resolved via gh-aw-manifest, no legacy scraping needed.

MCP server	Workflows
safeoutputs	301 (100%)
github	178 (59.1%)
agenticworkflows	44
serena	25
mcpscripts	12
tavily	5
sentry	4

Most-used tools: safeoutputs:missing_data/missing_tool/noop 295 each, github:get_commit/get_file_contents/etc. 170 each, safeoutputs:create_issue 147.

Interesting findings

1. Overwhelmingly schedule/dispatch-driven fleet: 293/301 (97.3%) support manual dispatch and 245/301 (81.4%) run on a cron schedule — this is primarily scheduled background automation, not event-reactive workflows.
2. Universal write isolation: all 301 agent jobs run with contents: read only (0 writes); every effective write happens in downstream safe-output jobs — the safe-outputs isolation pattern has no exceptions in the current fleet.
3. Engine concentration: copilot, codex, and claude together account for 85.1% of all engines (126+74+56 of 301); 13 lockfiles run on 10 other engines combined.
4. Fully reliable discussion-category detection: 92/92 create_discussion workflows resolved a category (or explicit default) with zero regex fallbacks — safe-outputs config parsing is robust.
5. Ledger safe-output schema in flux: push_repo_memory fell from 40 → 35 workflows (-12.5%) since 2026-09-29, while the old ledger_mutation (6) type is gone, replaced by two new types ledger_append (7) and ledger_request_compaction (6) — consistent with an in-progress memory/ledger safe-output migration.

Historical trends (2026-09-29 → 2026-10-01, 2 days)

Metric	2026-09-29	2026-10-01	Δ
Lockfiles	300	301	+1
Total bytes	47,089,492	47,386,965	+297,473 (+0.63%)
Avg size	156,965.0	157,431.8	+466.8
workflow_dispatch	292	293	+1
schedule trigger	244	245	+1
create_issue	146	147	+1
push_repo_memory	40	35	-5
copilot engine	125	126	+1
github MCP server	177	178	+1
union_any_write_workflows	300	301	+1

Net change is consistent with a single new or updated workflow added to the fleet (github MCP + create_issue + copilot engine all up by exactly 1), plus a separate, multi-workflow ledger safe-output schema migration (push_repo_memory down, ledger_append/ledger_request_compaction up).

Recommendations

• No corrective action needed — all self-checks passed (engine_unknown=0, permissions_unknown=0, safe_outputs_config_missing=0, discussion-category detection 100%).
• Confirm whether the push_repo_memory → ledger_append/ledger_request_compaction shift is an intentional schema migration; if unintentional, several workflows may be silently losing memory-persistence capability.
• Continue treating safe-output jobs as the sole locus of write capability during security review, since 100% of agent jobs remain read-only at the frontmatter-permission level.

References:

• §36921502836

Generated by 📊 Lockfile Statistics Analysis Agent · claude · agent · 83.3 AIC · ⌖ 6.45 AIC · ⊞ 6.5K · ◷

• expires on Oct 2, 2026, 12:32 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Lockfile Statistics Analysis Agent.

A newer discussion is available at Discussion #65096.