[lockfile-stats] Lockfile Statistics Audit — 2026-10-10

[github-actions[bot]]

Analyzed 334 compiled .github/workflows/*.lock.yml files (0 skipped) via single-script compact JSON analysis.

Executive summary

Metric	Value
Lockfiles	334
Total size	54,061,748 bytes (~51.6 MB)
Avg / min / max size	161,861 / 89,482 / 289,602 bytes
workflow_dispatch present	325
Workflows with create_discussion	92 (93 configured, 1 category unresolved)

File size distribution

• Avg 158 KB, ranging 87 KB – 283 KB — a fairly narrow spread, suggesting consistent scaffolding (safe-output tool defs, MCP boilerplate) dominates lockfile size rather than per-workflow prompt content.

Trigger analysis

Trigger	Count
workflow_dispatch	325
schedule	241
pull_request	43
workflow_call	5
issues	5
issue_comment	3
push	2
others (deployment_status, workflow_run, discussion, discussion_comment, pull_request_review_comment)	1 each

Top trigger combinations: schedule+workflow_dispatch (208), workflow_dispatch only (71), pull_request+schedule+workflow_dispatch (29), pull_request+workflow_dispatch (9).

Top cron frequency: 0 0 */2 * * (every 2 days) — 50 workflows, far ahead of the next-most-common pattern (3 workflows).

Safe outputs analysis

Universal safe-output scaffolding appears in ~327/334 workflows: missing_data, missing_tool, noop, report_incomplete, create_report_incomplete_issue.

Most common content-producing safe outputs:

Type	Count
create_issue	173
create_discussion	92
add_comment	74
create_pull_request	65
push_repo_memory	33
add_labels	32
upload_asset	26

Discussion categories:

Category	Count
audits	79
announcements	5
artifacts	2
dev	2
research	2
general	1
daily-news	1

1 workflow (pr-sous-chef.lock.yml) had create_discussion configured but no resolvable category. safe_outputs_config_missing = 1 (that same workflow's config was unparsable by the primary extractor).

Structural characteristics

Metric	Total	Max (single workflow)
Jobs	2,380	23
Steps	48,230	325
Script/run steps	21,435	97

Permission patterns (agent job)

All scopes observed are either read or write with zero workflows resolving to none on tracked scopes, and permissions_unknown = 0 (every lockfile had a parseable agent-job permissions block):

Scope	Read	Write
contents	334	0
issues	261	0
pull-requests	255	0
actions	140	0
discussions	53	0
security-events	14	0
copilot-requests	0	158
id-token	0	2

Note: the agent job itself is read-only/minimal-write by design — actual mutations happen via safe-output jobs. Union-across-jobs (any job in the workflow) tells the write story: 332/334 workflows (99.4%) grant some write scope somewhere in their job graph, most commonly issues (332), contents (228), copilot-requests (158), pull-requests (146), discussions (96).

Engine distribution (from gh-aw-metadata.agent_id)

Engine	Count
copilot	136
codex	76
claude	61
pi	35
aider	4
goose	4
agy	3
opencode	3
crush	2
cursor	2
deepseek-harness	2
gemini	2
kiro	2
pydantic-ai	2

engine_unknown = 0 — every lockfile resolved to a known engine.

Tool & MCP patterns

MCP server	Count
safeoutputs	310
github	185
work-queue	33
agenticworkflows	27
mcpscripts	25
serena	17

7 lockfiles fell back to legacy allowed-tool-comment scraping for MCP detection (no mcp_servers manifest array).

Interesting findings

1. copilot is now the dominant engine (136, ~41%), ahead of codex (76) and claude (61) — a notable shift if this repo was previously claude-majority.
2. Bi-daily scheduling dominates: 50 workflows share the exact cron 0 0 */2 * *, suggesting a shared template/default rather than per-workflow tuning.
3. Universal write exposure: 332/334 workflows (99.4%) grant write permission to at least one scope somewhere in their job graph — write-capability is effectively universal, with issues write being the most common (332).
4. copilot-requests: write appears in 158 workflows but never as read — a binary all-or-nothing permission for that scope.
5. Discussion-category coverage is nearly complete: 92/93 create_discussion workflows resolved a category; only pr-sous-chef.lock.yml needs investigation (likely a malformed or non-standard safe-outputs config block).

Historical trends (vs. 2026-10-09)

Metric	2026-10-09	2026-10-10	Δ
Lockfile count	334	334	0
Total bytes	53,401,626	54,061,748	+660,122
create_discussion workflows	92	92	0
Engine codex	77	76	−1
Engine copilot	135	136	+1

Net effect: one workflow appears to have migrated from codex to copilot since yesterday, with a modest overall size increase (+~0.6 MB across the fleet), consistent with incremental template/scaffolding growth rather than new workflow additions.

Recommendations

• Investigate pr-sous-chef.lock.yml's safe-outputs config — it's the one lockfile with an unresolved create_discussion category and a missing parseable GH_AW_SAFE_OUTPUTS_CONFIG.
• Consider whether the 50-workflow 0 0 */2 * * cron cluster is intentional load-spreading or an un-tuned default; bi-daily scheduling at identical times could cause runner contention.
• Given copilot-requests write permission is granted to 158 workflows with no corresponding read grants anywhere, confirm this is expected (write-only scope) rather than a permission-template artifact.

---

Methodology: single-script compact JSON analysis (lockfile_stats_v4.py, cached in /tmp/gh-aw/cache-memory/scripts/), summary JSON in /tmp/gh-aw/agent/lockfile-stats-summary.json. Historical comparisons sourced from /tmp/gh-aw/cache-memory/history/.

Generated by 📊 Lockfile Statistics Analysis Agent · claude · agent · 58.4 AIC · ⊞ 6.4K · ◷

• expires on Oct 11, 2026, 12:28 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Lockfile Statistics Analysis Agent.

A newer discussion is available at Discussion #67778.