[lockfile-stats] Lockfile Statistics Analysis — 2026-10-08

[github-actions[bot]]

Lockfile Statistics — 2026-10-08

Analyzed 333 compiled lockfiles in .github/workflows/*.lock.yml (0 skipped/malformed). Total size 50.8 MB, avg 156.2 KB/file (min 87.1 KB, max 281.3 KB).

File size distribution

Metric	Value
Count	333
Total	53,260,630 bytes (50.8 MB)
Average	159,941.8 bytes (156.2 KB)
Min	89,156 bytes (87.1 KB)
Max	288,087 bytes (281.3 KB)

Trigger analysis

Trigger	Workflows
workflow_dispatch	324 (97.3%)
schedule	243 (73.0%)
pull_request	43
workflow_call	5
issues	5
issue_comment	3
push	2
deployment_status / workflow_run / discussion / discussion_comment / pull_request_review_comment	1 each

Top trigger combinations: schedule+workflow_dispatch (210), workflow_dispatch only (68), pull_request+schedule+workflow_dispatch (29), pull_request+workflow_dispatch (9).

Top cron frequency: 0 0 */2 * * (every 2 days at midnight) — 50 workflows. All other distinct cron strings appear 2-3 times (highly staggered schedules).

Safe outputs analysis

Standard scaffolding (missing_data, missing_tool, noop, report_incomplete, create_report_incomplete_issue) present in 326/333 workflows (97.9%). Beyond scaffolding, by frequency:

Type	Count	Type	Count
create_issue	173	create_check_run	14
create_discussion	92	update_issue	10
add_comment	74	push_to_pull_request_branch	10
create_pull_request	65	max_bot_mentions	9
push_repo_memory	34	dispatch_workflow	8
add_labels	32	ledger_append	7
upload_asset	26	close_issue / remove_labels	7
mentions	24	ledger_request_compaction	6
create_pull_request_review_comment / submit_pull_request_review	16	comment_memory	6
upload_artifact	15	(47 more long-tail types, 1-5 each)

Discussion categories (93 workflows configure create_discussion; category resolved for 92/93 = 98.9%):

Category	Count
audits	79
announcements	5
artifacts	2
dev	2
research	2
general	1
daily-news	1

Unresolved: pr-sous-chef.lock.yml — no GH_AW_SAFE_OUTPUTS_CONFIG env var found (likely a stale compiled lockfile; also the sole safe_outputs_config_missing case in the corpus).

Structural characteristics

Metric	Total	Max (single workflow)
Jobs	2,376	23
Steps	48,114	324
Script (run) steps	21,411	97

Permission patterns (agent job)

Scope	Read	Write	None/unset
contents	333	0	0
issues	261	0	72
pull-requests	255	0	78
actions	124	0	209
discussions	53	0	280
copilot-requests	0	157	176
security-events	14	0	319
id-token	0	2	331
models / packages / vulnerability-alerts / deployments / drives	1 each	0	332 each

permissions_unknown: 0 — every lockfile's agent-job permissions resolved cleanly.

Union (any job) write grants — 330/333 workflows (99.1%) grant write on at least one scope: issues (330), contents (212), copilot-requests (157), pull-requests (146), discussions (96), actions (125), checks (14), id-token (3), others ≤3.

Engine distribution

Engine	Count	Share
copilot	134	40.2%
codex	77	23.1%
claude	61	18.3%
pi	35	10.5%
aider / goose	4 each	—
agy / opencode	3 each	—
crush / cursor / deepseek-harness / gemini / kiro / pydantic-ai	2 each	—

engine_unknown: 0 — every lockfile's engine resolved via gh-aw-metadata agent_id (or fallback).

Tool & MCP patterns

MCP server	Workflows
safeoutputs	309 (92.8%)
github	184 (55.3%)
agenticworkflows	27
mcpscripts	25
serena	17
work-queue	16
agy-native	3
tavily	3
sentry	2
kreuzberg / graft / ast-grep / grafana / deepwiki / microsoftdocs	1 each

7 lockfiles required legacy fallback parsing (# - mcp__... comments) instead of a gh-aw-manifest JSON block.

Interesting findings

1. Near-universal manual triggerability: 324/333 workflows (97.3%) support workflow_dispatch, and the dominant combo schedule+workflow_dispatch (210, 63%) shows almost every scheduled workflow is also manually runnable.
2. Copilot is now the leading engine (134, 40.2%), ahead of Codex (77) and Claude (61). The agy engine is a new entrant this period (0→3), paired with a new agy-native MCP server (0→3).
3. work-queue MCP usage nearly tripled day-over-day (6→16, +167%), the largest relative mover in the tool/MCP data — suggests a cluster of workflows adopted shared work-queue coordination recently.
4. audits dominates discussion categories (79/92, 85.9% of create_discussion workflows) — consistent with a large population of reporting/audit-style workflows like this one.
5. Non-standard copilot-requests write scope granted to 157 workflows (47%) — not a standard GitHub Actions permission scope, almost certainly Copilot-engine-specific usage/billing tracking; worth a sanity check that it's intentional and scoped only to Copilot-engine workflows.
6. Only 1 of 333 lockfiles (pr-sous-chef.lock.yml) had unresolved safe-outputs/discussion-category detection — 99.7% full extraction coverage across the corpus.

Historical trends (vs. 2026-10-07)

Metric	2026-10-07	2026-10-08	Δ
Lockfiles	327	333	+6
Total bytes	52,101,388	53,260,630	+1,159,242
workflow_dispatch	319	324	+5
create_discussion workflows	93	93	0
Engine: copilot	132	134	+2
Engine: pi	34	35	+1
Engine: agy	0	3	+3 (new)
MCP: work-queue	6	16	+10
MCP: safeoutputs	303	309	+6
MCP: github	181	184	+3
Safe output: create_issue	170	173	+3
Safe output: push_repo_memory	35	34	-1

No change in discussion category distribution day-over-day.

Recommendations

• Investigate pr-sous-chef.lock.yml — its GH_AW_SAFE_OUTPUTS_CONFIG could not be located; likely needs a gh aw compile refresh.
• Audit the 157 workflows granted write on copilot-requests to confirm the scope is intentional and limited to Copilot-engine workflows.
• With 330/333 workflows (99%) granting some write permission across their job matrix, schedule a periodic least-privilege review.
• Track the work-queue MCP adoption spike (+167% day/day) and the new agy engine entrant in future reports to see if these represent an ongoing migration.

Methodology note

Single-script compact JSON analysis: one Python script parsed all .lock.yml files via yaml.safe_load, extracting engine/permissions/safe-outputs from gh-aw-metadata/gh-aw-manifest comments and the GH_AW_SAFE_OUTPUTS_CONFIG env var (not the always-empty top-level permissions: {}), then wrote one compact summary JSON consumed for this report.

Generated by 📊 Lockfile Statistics Analysis Agent · claude · agent · 72.4 AIC · ⊞ 6.4K · ◷

• expires on Oct 9, 2026, 12:33 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Lockfile Statistics Analysis Agent.

A newer discussion is available at Discussion #67273.