[lockfile-stats] Lockfile Statistics Analysis — 2026-10-06

[github-actions[bot]]

Lockfile Statistics — 2026-10-06

Overview: Analyzed all 323 .github/workflows/*.lock.yml files (0 skipped). Combined size ~49.0 MB (avg 155.2 KB/file, range 86.6 KB–254.3 KB). No prior history was found in cache-memory, so this run establishes the baseline for future trend comparisons.

Key metrics

Metric	Value
Lockfiles analyzed	323 (0 skipped)
Total / avg size	49.0 MB / 155.2 KB
workflow_dispatch present	315 (97.5%)
schedule present	248 (76.8%)
Workflows using create_discussion	93 (category resolved for 92)
Workflows with any job write perm	323 (100%)
Engines detected	12 (0 unknown)
MCP servers in use	15 (safeoutputs in 299 workflows)

Trigger analysis

Top combinations: schedule+workflow_dispatch (215), workflow_dispatch only (54), pull_request+schedule+workflow_dispatch (29), pull_request+workflow_dispatch (9).

Full trigger and cron breakdown

Trigger	Count
workflow_dispatch	315
schedule	248
pull_request	43
issues	5
workflow_call	4
issue_comment	3
push	2
deployment_status	1
workflow_run	1
discussion	1
discussion_comment	1
pull_request_review_comment	1

Most common cron: 0 0 */2 * * (every 2 days at midnight) — shared by 46 workflows. Next most frequent crons each appear 2–3 times, otherwise highly diverse.

Safe outputs analysis

Five baseline types appear in 316/323 workflows (97.8%) — noop, missing_data, missing_tool, report_incomplete, create_report_incomplete_issue — consistent with shared compiler-injected scaffolding rather than per-workflow choice.

Safe output type frequency (top 15 of 55)

Type	Count
create_issue	166
create_discussion	92
add_comment	75
create_pull_request	66
push_repo_memory	35
add_labels	32
upload_asset	26
mentions	23
create_pull_request_review_comment	16
submit_pull_request_review	16
upload_artifact	15
create_check_run	14
update_issue	10
push_to_pull_request_branch	10
max_bot_mentions	9

40 additional long-tail types appear 1–7 times each (e.g. jira_*, linear_create_issue, send-slack-message).

Discussion categories (92 resolved of 93 create_discussion workflows): audits 79, announcements 5, artifacts 2, dev 2, research 2, general 1, daily-news 1. One workflow — pr-sous-chef.lock.yml — could not be resolved by either the JSON config path or the regex fallback (safe_outputs_config_missing: 1); flagged for manual follow-up.

Structural characteristics

Metric	Total	Max (single workflow)
Jobs	2,321	14
Steps	46,842	214
Script (run:) steps	20,730	94

Average ~7.2 jobs and ~145 steps per workflow; script steps make up ~44% of all steps.

Job-level timeout-minutes values cluster tightly: 10 min (362 jobs), 45 min (323 jobs), 60 min (316 jobs) — these counts track closely with per-workflow job roles (detection/safe-output/agent jobs), suggesting standardized timeout tiers across the fleet.

Permission patterns (agent job)

Scope	Read	Write
contents	323 (100%)	0
issues	263 (81.4%)	0
pull-requests	257 (79.6%)	0
actions	115 (35.6%)	0
discussions	53 (16.4%)	0
copilot-requests	0	148 (45.8%)
security-events	14 (4.3%)	0
id-token	0	2

permissions_unknown: 0 — every lockfile's agent-job permissions were resolved.

Union across all jobs per workflow (any job granting write): issues write in 323/323 (100%) workflows, contents write in 213 (65.9%), copilot-requests write in 148 (45.8%), pull-requests write in 147 (45.5%), discussions write in 97 (30.0%). All 323 workflows (100%) grant some write scope via a dedicated safe-output writer job, even though per-engine agent jobs themselves stay read-only on contents.

Engine distribution

(from gh-aw-metadata agent_id, 0 unresolved)

Engine	Count	Share
copilot	132	40.9%
codex	77	23.8%
claude	59	18.3%
pi	32	9.9%
aider	4	1.2%
goose	4	1.2%
opencode	3	0.9%
crush, cursor, deepseek-harness, gemini, kiro, pydantic-ai	2 each	0.6% each

Tool & MCP patterns

safeoutputs MCP server appears in 299 workflows (92.6%), github in 181 (56.0%), agenticworkflows in 26, mcpscripts in 19, serena in 17. Long tail: work-queue (6), tavily (3), sentry (2), and 7 servers used once each (kreuzberg, graft, ast-grep, grafana, ruflo, deepwiki, microsoftdocs). 7 workflows required the legacy # - mcp__... comment fallback instead of the structured manifest.

Interesting findings

1. Universal issues:write — all 323 workflows (100%) grant some job issues: write, even though only 166 (51%) actually use create_issue as a safe output. This points to the safe-output writer job requesting a fixed permission set regardless of which outputs a workflow actually emits — a candidate for least-privilege tightening.
2. Scaffolding dominates safe-output counts — the top 5 safe-output types by frequency are all generic error/no-op handlers (316/323 each), not functional outputs; functional output usage is much more varied and long-tailed (55 distinct types total).
3. audits is the dominant discussion category — 79 of 92 resolved categories (85.9%), reflecting that audit-style reporting agents (like this one) are the heaviest users of create_discussion.
4. copilot-requests: write (a non-standard, Copilot-specific permission scope) appears in 148 workflows (45.8%) — nearly half the fleet is tracking premium request budgets.
5. Engine diversity — 12 distinct engines are in active use; copilot leads at 41% but codex, claude, and pi collectively account for the majority of the remainder, indicating ongoing cross-engine experimentation rather than consolidation on one runtime.

Historical trends

No prior summary existed in /tmp/gh-aw/cache-memory/history/ — this run is the baseline. Future runs will diff against 2026-10-06.json.

Recommendations

• Audit why issues: write is granted in 100% of workflows regardless of configured safe outputs; scope the writer job's permissions to the safe-output types actually declared per workflow.
• Investigate pr-sous-chef.lock.yml, the one workflow where GH_AW_SAFE_OUTPUTS_CONFIG could not be parsed by either the primary or fallback path.
• Consider staggering the 46 workflows sharing the 0 0 */2 * * cron to reduce simultaneous-trigger load on shared runners.
• Given generic safe-output scaffolding (noop/missing_data/missing_tool/report_incomplete) is near-universal, evaluate whether it can be deduplicated or shared to reduce the ~49 MB total lockfile footprint.

Methodology: single-script compact JSON analysis (lockfile_stats_v4.py, cached under /tmp/gh-aw/cache-memory/scripts/).

References:

• Run §37526324755

Generated by 📊 Lockfile Statistics Analysis Agent · claude · agent · 81.7 AIC · ⌖ 6.52 AIC · ⊞ 6.4K · ◷

• expires on Oct 7, 2026, 12:32 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Lockfile Statistics Analysis Agent.

A newer discussion is available at Discussion #66681.