[lockfile-stats] Lockfile Statistics Audit — 2026-10-14

[github-actions[bot]]

Executive summary

Metric	Value
Lockfiles analyzed	344 (0 skipped)
Total size	55,904,001 bytes (~53.3 MB)
Avg / min / max size	162,512 / 90,592 / 290,779 bytes
Total jobs / steps / script-steps	2,436 / 50,137 / 21,937
Engines detected	13 (0 unknown)

Methodology: single-script compact JSON analysis (cached analyzer lockfile_stats_v4.py, reused from prior runs; self-checks on discussion-category and engine/permission resolution passed).

File size distribution

Stat	Bytes
Min	90,592
Avg	162,512
Max	290,779
Total	55,904,001

Trigger analysis

Trigger	Count
workflow_dispatch	335
schedule	251
pull_request	47
workflow_call	5
issues	5
issue_comment	3
push	2
deployment_status / workflow_run / discussion / discussion_comment / pull_request_review_comment	1 each

Top trigger combinations: schedule+workflow_dispatch (214), workflow_dispatch only (71), pull_request+schedule+workflow_dispatch (33), pull_request+workflow_dispatch (9).

Most common cron: 0 0 */2 * * (every 2 days) — 60 workflows, up from 57 yesterday.

Safe outputs analysis

Every workflow carries the baseline safe-output set (missing_data, missing_tool, noop, report_incomplete, create_report_incomplete_issue — 337 each). Beyond baseline, the most common write types:

Safe output	Count
create_issue	183
create_discussion	92
add_comment	74
create_pull_request	65
push_repo_memory	33
add_labels	32
upload_asset	26
mentions	24

Discussion categories (93 workflows configure create_discussion; 92 resolved to a category, 1 unresolved: pr-sous-chef.lock.yml has no detectable GH_AW_SAFE_OUTPUTS_CONFIG/category — same gap as prior runs, within the 10% self-check tolerance):

Category	Count
audits	79
announcements	5
artifacts	2
dev	2
research	2
general	1
daily-news	1

Structural characteristics

Metric	Total	Max (single workflow)
Jobs	2,436	23
Steps	50,137	326
Script steps (run:)	21,937	97

Timeout distribution (job timeout-minutes): 10min ×386, 45min ×341, 60min ×333, with a long tail (2–300min) across 11 remaining workflows.

Permission patterns

Derived from jobs.agent.permissions (top-level permissions: {} carries no signal) — all granted scopes in the agent job are read; no agent-job scope is granted write directly:

Scope	Read	Write
contents	344	0
pull-requests	255	0
issues	261	0
actions	140	0
discussions	53	0
security-events	14	0
copilot-requests	0	166
id-token	0	4

Union across all jobs in each workflow (where write access actually happens, e.g. in a separate safe-outputs job): 342/344 workflows (99.4%) grant some write scope, most commonly issues (342), contents (228), discussions (96), pull-requests (151), copilot-requests (166 — Copilot engine billing/usage scope).

Engine distribution

Engine	Count	Share
copilot	141	41.0%
codex	77	22.4%
claude	62	18.0%
pi	38	11.0%
aider	4	1.2%
goose	4	1.2%
agy	3	0.9%
opencode	3	0.9%
others (crush, cursor, deepseek-harness, gemini, kiro, pydantic-ai)	2 each	—

Tool & MCP patterns

MCP server	Workflows
safeoutputs	321
github	194
work-queue	33
agenticworkflows	27
mcpscripts	26
serena	16
agy-native	3
tavily	3

7 lockfiles lack a mcp_servers manifest entry and were resolved via the legacy # - mcp__... comment fallback.

Interesting findings

1. Copilot is now the plurality engine at 141/344 workflows (41%), ahead of codex (77) and claude (62) — the fleet has diversified well beyond a single-engine baseline.
2. Write access is almost universal but indirect: 99.4% of workflows grant some write scope at the union level, yet the agent job itself never holds write directly — confirming the safe-outputs pattern (agent proposes, a separate job executes) is consistently applied fleet-wide.
3. copilot-requests: write appears in 166 workflows, closely tracking the Copilot engine count (141) plus some margin — likely workflows using Copilot as a secondary/fallback engine.
4. Bi-daily (0 0 */2 * *) scheduling dominates cron usage (60 workflows, 17% of all lockfiles), suggesting a strong fleet convention for low-frequency audits.
5. Only 1 of 93 create_discussion workflows (pr-sous-chef.lock.yml) has an unresolved discussion category — a persistent, stable gap (unchanged for at least 2 days), likely a workflow using a non-standard safe-outputs config path rather than an extraction bug.

Historical trends (vs 2026-10-13)

Metric	2026-10-13	2026-10-14	Δ
Lockfiles	341	344	+3
Total bytes	55,183,653	55,904,001	+720,348 (+1.3%)
workflow_dispatch	332	335	+3
schedule	248	251	+3
create_issue	180	183	+3
Jobs / Steps / Scripts	2,422 / 49,435 / 21,814	2,436 / 50,137 / 21,937	+14 / +702 / +123
copilot engine	140	141	+1
codex engine	76	77	+1
pi engine	37	38	+1
id-token write	2	4	+2
mcp: safeoutputs	318	321	+3
Cron 0 0 */2 * *	57	60	+3

The +3 lockfile growth is consistent across nearly every metric (triggers, jobs, engines), indicating 3 new workflows added using the standard scaffolding (schedule+workflow_dispatch, bi-daily cron, safe-outputs job split) rather than structural drift in existing workflows.

Recommendations

• Investigate pr-sous-chef.lock.yml's safe-outputs config to close the one remaining unresolved discussion category (low priority, stable over time).
• Given copilot-requests: write (166) exceeds the copilot engine count (141), confirm whether non-Copilot-engine workflows correctly need this scope, or if it's over-granted as a default.
• No action needed on permissions hygiene: the agent-job-read / union-job-write split is fleet-wide and matches the intended safe-outputs design.

References:

• §38631358018

Generated by 📊 Lockfile Statistics Analysis Agent · claude · agent · 67.6 AIC · ⊞ 6.5K · ◷

• expires on Oct 15, 2026, 12:27 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Lockfile Statistics Analysis Agent.

A newer discussion is available at Discussion #69101.