[lockfile-stats] Lockfile Statistics Audit — 2026-10-07

[github-actions[bot]]

Overview: 327 compiled workflow lockfiles (.github/workflows/*.lock.yml), 0 malformed/skipped. Total size 52,101,388 bytes (~49.7 MB), avg 159,332 bytes, min 87,611, max 259,679. +4 lockfiles vs. 2026-10-06.

Key metrics

Area	Headline
Triggers	workflow_dispatch 319 (97.6%), schedule 251 (76.8%), pull_request 43 (13.1%)
Top combo	schedule+workflow_dispatch 218 (66.7%)
Safe outputs	Universal baseline (noop/missing_tool/missing_data/report_incomplete) in 320 workflows; create_issue 170, create_discussion 92, add_comment 74, create_pull_request 65
Discussion categories	audits 79, announcements 5, artifacts 2, dev 2, research 2, general 1, daily-news 1 (92/93 resolved)
Engines	copilot 132 (40.4%), codex 77 (23.5%), claude 61 (18.7%), pi 34 (10.4%), + 9 others ≤4 each; 0 unresolved
Permissions	100% of workflows (327/327) show a write scope in the job-union, but it's concentrated in copilot-requests (154) and id-token (3) — contents/issues/pull-requests are read-only at the agent job in every case
Structure	2,334 jobs (avg 7.1/wf, max 14), 47,357 steps (avg 144.8, max 215), 21,103 script steps (avg 64.5, max 95)
MCP usage	safeoutputs 303, github 181, agenticworkflows 27, mcpscripts 22, serena 17, 7 lockfiles via comment-scrape fallback

File size distribution

• Count: 327, skipped: 0
• Total: 52,101,388 bytes | Avg: 159,332 | Min: 87,611 | Max: 259,679

Trigger analysis

Trigger	Count
workflow_dispatch	319
schedule	251
pull_request	43
issues	5
workflow_call	4
issue_comment	3
push	2
deployment_status / workflow_run / discussion / discussion_comment / pull_request_review_comment	1 each

Top combinations: schedule+workflow_dispatch 218, workflow_dispatch only 55, pull_request+schedule+workflow_dispatch 29, pull_request+workflow_dispatch 9, pull_request 3.

Cron clustering: 0 0 */2 * * appears in 50 of 251 scheduled workflows (~20%) — by far the most common single cron expression; the remaining top crons each appear 2–3 times.

Safe outputs analysis

Baseline tools present in ~98% of workflows: missing_data, missing_tool, noop, report_incomplete, create_report_incomplete_issue (320 each).

Content-producing types: create_issue 170, create_discussion 92, add_comment 74, create_pull_request 65, push_repo_memory 35, add_labels 32, upload_asset 26, mentions 23, create_pull_request_review_comment/submit_pull_request_review 16 each.

Long tail (1 workflow each): Jira (jira_add_comment, jira_add_label, jira_create_issue, jira_update_issue), linear_create_issue, Slack variants, create_project_status_update, update_project, etc.

create_discussion_workflows = 93, discussion_category_detected = 92 (99%). One unresolved: pr-sous-chef.lock.yml (same file unresolved on both 10-06 and 10-07 — likely a non-literal/dynamic category value). safe_outputs_config_missing = 1 lockfile.

Structural characteristics

• Jobs: 2,334 total, avg 7.1/workflow, max 14
• Steps: 47,357 total, avg 144.8/workflow, max 215
• Script steps: 21,103 total, avg 64.5/workflow, max 95
• Timeout-minutes distribution (per job): 10min → 360 jobs, 45min → 327, 60min → 320, 90min → 3, 120min → 2, 5min → 2, 180/3/15min → 1 each

Permission patterns (agent job + job-union)

Scope	Read	Write	None
contents	327	0	0
issues	261	0	0
pull-requests	255	0	0
discussions	53	0	0
actions	115	0	0
security-events	14	0	0
copilot-requests	0	154	0
id-token	0	2	0

Union-of-jobs write grants: issues 327, contents 212, copilot-requests 154, pull-requests 146, discussions 96, actions 117, checks 14, id-token 3. workflows_with_any_write = 327/327 (100%), permissions_unknown = 0.

The agent job itself never carries write on contents/issues/pull-requests/discussions — all observed writes route through either a dedicated downstream job (e.g., a PR-push job) or the safe-outputs mechanism, not direct agent-job permissions.

Engine distribution

Engine	Count	Share
copilot	132	40.4%
codex	77	23.5%
claude	61	18.7%
pi	34	10.4%
aider	4	1.2%
goose	4	1.2%
opencode	3	0.9%
crush / cursor / deepseek-harness / gemini / kiro / pydantic-ai	2 each	0.6%

engine_unknown = 0 (fully resolved via gh-aw-metadata).

Tool & MCP patterns

Server	Count
safeoutputs	303
github	181
agenticworkflows	27
mcpscripts	22
serena	17
work-queue	6
tavily	3
sentry	2
kreuzberg / graft / ast-grep / grafana / deepwiki / microsoftdocs	1 each

mcp_fallback_count = 7 lockfiles required comment-scrape fallback (no mcp_servers in manifest).

Interesting findings

1. Writes are mediated, not direct: every workflow (327/327) shows some write scope in the job-union, but it's overwhelmingly copilot-requests (154) and id-token (3) — never contents/issues/pull-requests at the agent job. This confirms the safe-outputs architecture is holding across the whole fleet, not just a subset.
2. One cron dominates: 0 0 */2 * * covers ~20% of all scheduled workflows (50/251), far more than any other expression — likely a copy-pasted default rather than intentional scheduling, and a candidate for staggering to avoid synchronized runner contention.
3. Engine mix is Copilot-led but diversifying: 13 distinct engines in use; Copilot/Codex/Claude cover ~83% between them, while 9 engines each power ≤4 workflows, suggesting active experimentation with custom engines.
4. One stubborn category-detection gap: pr-sous-chef.lock.yml is the only create_discussion workflow whose category wasn't statically resolvable, and it's been that way for at least two consecutive days — worth checking whether its category is set via a dynamic expression rather than a literal string.
5. Long tail of bespoke integrations: Jira, Linear, and several Slack-posting safe-output types each appear in exactly one lockfile, indicating one-off integrations rather than shared patterns — candidates for consolidation if adoption grows.

Historical trends (2026-10-06 → 2026-10-07)

Metric	10-06	10-07	Δ
Lockfiles	323	327	+4
Total bytes	51,345,375	52,101,388	+756,013
workflow_dispatch	315	319	+4
schedule	248	251	+3
Jobs (total)	2,321	2,334	+13
Steps (total)	46,842	47,357	+515
Script steps (total)	20,730	21,103	+373
create_issue	166	170	+4
engine: claude	59	61	+2
engine: pi	32	34	+2
MCP: safeoutputs	299	303	+4
MCP: mcpscripts	19	22	+3
discussion_categories	unchanged	unchanged	0
issues (read, agent job)	263	261	-2
pull-requests (read, agent job)	257	255	-2

The 4 new lockfiles didn't adopt create_discussion (category distribution unchanged), and newer workflows trend toward slightly narrower issues/pull-requests read grants relative to the growing lockfile count.

Recommendations

1. Stagger the 0 0 */2 * * cron cluster across times/days to reduce simultaneous runner load.
2. Investigate pr-sous-chef.lock.yml's unresolved create_discussion category — confirm it's intentional (dynamic value) rather than a misconfiguration.
3. Keep mediating writes through safe-outputs rather than granting direct contents/issues/pull-requests write at the agent job — the current 100% read-only-at-agent pattern is a strong security baseline worth preserving.
4. If Jira/Linear/Slack safe-output usage grows beyond single workflows, consider extracting shared reusable configuration.
5. Track the Claude/Pi engine growth (+2 each day-over-day) as a leading indicator for future engine-mix planning.

Methodology: single-script compact JSON analysis (lockfile_stats_v4.py, cached at /tmp/gh-aw/cache-memory/scripts/), parsing gh-aw-metadata/gh-aw-manifest header comments and GH_AW_SAFE_OUTPUTS_CONFIG env JSON per lockfile; no full-file greps outside the analyzer.

References: §37681896110

Generated by 📊 Lockfile Statistics Analysis Agent · claude · agent · 74.4 AIC · ⊞ 6.4K · ◷

• expires on Oct 8, 2026, 12:33 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Lockfile Statistics Analysis Agent.

A newer discussion is available at Discussion #66993.