[lockfile-stats] Lockfile Statistics Report — 2026-10-16

[github-actions[bot]]

Executive summary

• 344 compiled .lock.yml workflows analyzed, 0 skipped
• Total size 53.7 MB (56,333,124 bytes); avg 163.8 KB, min 89.0 KB (91,107 B), max 291.2 KB (298,218 B)
• 93 workflows configure create_discussion; discussion categories resolved for 92/93
• Engine detection and permission detection: 0 unknown across all 344 lockfiles

File size distribution

Metric	Value
Count	344
Total	53.7 MB
Average	163.8 KB
Min	89.0 KB
Max	291.2 KB

Trigger analysis

Trigger	Workflows	%
workflow_dispatch	335	97%
schedule	251	73%
pull_request	47	14%
workflow_call	5	1%
issues	5	1%
issue_comment	3	<1%
push	2	<1%
discussion / discussion_comment / workflow_run / deployment_status / pull_request_review_comment	1 each	<1%

Top trigger combinations: schedule+workflow_dispatch (214, 62%), workflow_dispatch only (71, 21%), pull_request+schedule+workflow_dispatch (33, 10%), pull_request+workflow_dispatch (9).

Dominant cron: 0 0 */2 * * (every 2 days at midnight UTC) used by 60 workflows — far ahead of any other schedule (next most common crons appear only 2–3 times each).

Safe outputs analysis

Type	Count	% of 344
noop / missing_tool / missing_data / report_incomplete / create_report_incomplete_issue	337	98%
create_issue	183	53%
create_discussion	92	27%
add_comment	74	21%
create_pull_request	65	19%
push_repo_memory	33	10%
add_labels	32	9%
upload_asset	26	8%
mentions	24	7%
create_pull_request_review_comment / submit_pull_request_review	16 each	5%

Long tail (1–10 workflows each): upload_artifact, create_check_run, update_issue, push_to_pull_request_branch, dispatch_workflow, close_issue, remove_labels, ledger_append, assign_to_agent, link_sub_issue, plus one-off integrations (jira_*, linear_create_issue, send-slack-message, create_code_scanning_alert, etc).

Discussion categories (92 resolved of 93 configured):

Category	Count
audits	79
announcements	5
artifacts	2
dev	2
research	2
general	1
daily-news	1

Detection gap detail

• discussion_category_unresolved: 1 workflow — pr-sous-chef.lock.yml
• safe_outputs_config_missing: 1 lockfile (same workflow) — no GH_AW_SAFE_OUTPUTS_CONFIG env var found and no text-fallback match either, so its create_discussion usage (if any) could not be confirmed from the lockfile alone.

Structural characteristics

Metric	Total	Avg/workflow	Max
Jobs	2,439	7.1	23
Steps	50,378	146.4	326
Script steps (run:)	22,144	64.4	97

Timeout distribution (per job, top values): 10 min (386), 45 min (341), 60 min (333); long tail from 2–300 min.

Permission patterns (agent job)

Scope	read	write
contents	344 (100%)	0
issues	261 (76%)	0
pull-requests	255 (74%)	0
actions	140 (41%)	0
discussions	53 (15%)	0
copilot-requests	0	166 (48%)
security-events	14 (4%)	0
id-token	0	4 (1%)

The agent job itself is almost entirely read-only; writes happen in separate jobs. Taking the union across all jobs per workflow, write access is far more common: issues write in 342/344 (99%), contents write in 229 (67%), copilot-requests write in 166 (48%), pull-requests write in 151 (44%), discussions write in 96 (28%). 342/344 (99%) workflows grant some write scope somewhere — consistent with the safe-outputs pattern (read-only agent job + a privileged output-application job).

Engine distribution

(from gh-aw-metadata → agent_id, 0 unknown)

Engine	Count	%
copilot	141	41%
codex	77	22%
claude	62	18%
pi	38	11%
aider	4	1%
goose	4	1%
agy	3	<1%
opencode	3	<1%
crush, cursor, deepseek-harness, gemini, kiro, pydantic-ai	2 each	<1%

Tool & MCP patterns

MCP server	Workflows
safeoutputs	321 (93%)
github	194 (56%)
work-queue	33
agenticworkflows	27
mcpscripts	26
serena	16
agy-native / tavily	3 each
sentry	2
kreuzberg, graft, ast-grep, grafana, deepwiki, microsoftdocs	1 each

7 lockfiles had no gh-aw-manifest and fell back to scraping allowed-tool comments.

Interesting findings

1. Nearly every workflow (98%, 337/344) carries the same baseline safe-output scaffold (noop, missing_tool, missing_data, report_incomplete), indicating a shared, consistently-applied template rather than ad hoc configuration.
2. A single cron expression, 0 0 */2 * *, is used by 60 workflows (17% of all lockfiles) — a notable scheduling concentration that could cause runner contention every other day at 00:00 UTC.
3. Engine choice is diverse but concentrated: copilot, codex, and claude together account for 81% of workflows, with 10 other engines splitting the remaining 19%.
4. The agent job is read-only in effectively all workflows (contents: 344/344 read, 0 write), while 99% of workflows grant some write scope via a separate job — the safe-outputs separation-of-privilege pattern is close to universal.
5. One workflow, pr-sous-chef.lock.yml, is the sole lockfile with neither a resolvable safe-outputs config nor a confirmed discussion category, despite 92 of 93 create_discussion workflows resolving cleanly — worth a manual check for compiler drift.

Historical trends (vs. 2026-10-15)

Metric	2026-10-15	2026-10-16	Δ
Lockfiles	344	344	0
Total bytes	56,086,698	56,333,124	+246,426 (+0.44%)
Avg bytes	163,042.7	163,759.1	+716.4
Max bytes	291,249	298,218	+6,969
Total steps	50,326	50,378	+52
Script steps	22,093	22,144	+51

No changes in trigger mix, safe-output types, engine distribution, or permission patterns day-over-day — growth is incremental (existing workflows gained a few steps/bytes), not structural.

Recommendations

1. Investigate pr-sous-chef.lock.yml for a missing/malformed GH_AW_SAFE_OUTPUTS_CONFIG emission.
2. Consider spreading the 60 workflows sharing the 0 0 */2 * * cron across different times to reduce simultaneous runner load.
3. Review the long tail of single-use safe-output integrations (jira_*, linear_create_issue, Slack posting variants) for consolidation opportunities.
4. Engine/permission/discussion-category detection all resolved cleanly (0 unknown engines, 0 unknown permissions, 1 unresolved category) — current compiler output remains consistent with this analyzer's assumptions; no schema changes needed.

Methodology

Single-script compact JSON analysis: one cached Python analyzer (lockfile_stats_v4.py, reused from cache-memory) parsed all .github/workflows/*.lock.yml files in one pass, extracting engine/permission/safe-output signals from gh-aw-metadata/gh-aw-manifest header comments and the GH_AW_SAFE_OUTPUTS_CONFIG env var (with regex fallback), and wrote a compact summary JSON consumed for this report.

References: §38961698540

Generated by 📊 Lockfile Statistics Analysis Agent · claude · agent · 52.3 AIC · ⌖ 1.07 AIC · ⊞ 6.5K · ◷

• expires on Oct 17, 2026, 12:29 PM UTC-08:00