[lockfile-stats] Lockfile Statistics Analysis — 2026-10-21 (346 workflows)

[github-actions[bot]]

Overview

Analyzed 346 compiled .lock.yml workflows in .github/workflows/ as of 2026-10-21. 0 malformed lockfiles skipped. Compared against the prior snapshot from 2026-10-19 (344 lockfiles).

Metric	Value
Lockfiles	346
Total size	61,771,416 bytes (≈58.9 MiB)
Avg / min / max size	178,530 / 100,227 / 319,556 bytes
workflow_dispatch enabled	336 (97.1%)
Engines detected	14 (0 unknown)
Agent-job permissions resolved	346 / 346 (0 unknown)

File size distribution

• Avg 174.3 KiB, min 97.9 KiB, max 312.1 KiB — a fairly narrow, compiler-dominated size band (most bytes are boilerplate, not prompt content).

Trigger analysis

Top triggers:

Trigger	Count
workflow_dispatch	336
schedule	251
pull_request	47
workflow_call	5
issues	5
issue_comment	3
push	2

Top trigger combinations:

Combination	Count
schedule + workflow_dispatch	214
workflow_dispatch (only)	72
pull_request + schedule + workflow_dispatch	33
pull_request + workflow_dispatch	9

Cron frequency: 0 0 */2 * * (every 2 hours) dominates with 60 workflows; all other cron expressions appear ≤3 times — a sharp concentration on one cadence.

Safe outputs analysis

Four "infrastructure" outputs are present in nearly every workflow: noop, report_incomplete, report_missing_data, report_missing_tool (339/346 each, 98%), plus create_report_incomplete_issue (338) — these read as compiler-injected defaults, not author choices.

Business-facing outputs by frequency:

Type	Count	% of lockfiles
create_issue	183	52.9%
create_discussion	92	26.6%
add_comment	74	21.4%
create_pull_request	66	19.1%
push_repo_memory	33	9.5%
add_labels	32	9.2%

safe_outputs_config_missing: 1 lockfile (likely a non-agentic/job-only workflow).

Discussion categories (93 workflows configure create_discussion, 92 resolved — see Findings):

Category	Count
audits	79
announcements	5
artifacts	2
dev	2
research	2
general	1
daily-news	1

Structural characteristics

Metric	Avg	Max
Jobs / workflow	9.09	25
Steps / workflow	156.6	342
Script (run:) steps / workflow	64.6	99

Total: 3,145 jobs, 54,195 steps, 22,337 script steps across 346 lockfiles.

Permission patterns

From jobs.agent.permissions (the frontmatter-equivalent scope), fully resolved for all 346 workflows:

Scope	read	write
contents	346	0
issues	261	0
pull-requests	255	0
copilot-requests	0	168
discussions	52	0
actions	139	0
security-events	15	0
id-token	0	4

The agent job itself is almost entirely read-only (writes happen via safe-outputs, not direct job permissions) except copilot-requests (168 workflows) and id-token (4 workflows).

Union across all jobs per workflow (any job granting write):

Scope	Workflows with write
id-token	346 (100%)
issues	343 (99.1%)
contents	230 (66.5%)
copilot-requests	168 (48.6%)
pull-requests	153 (44.2%)
discussions	97 (28.0%)

All 346 workflows now grant some write scope in at least one job (workflows_with_any_write).

Engine distribution

(from gh-aw-metadata agent_id, 0 unresolved)

Engine	Count	%
copilot	143	41.3%
codex	76	22.0%
claude	63	18.2%
pi	38	11.0%
aider / goose	4 each	1.2%
agy / opencode	3 each	0.9%
crush / cursor / deepseek-harness / gemini / kiro / pydantic-ai	2 each	0.6%

Tool & MCP patterns

MCP server	Count
safeoutputs	317
github	192
work-queue	33
mcpscripts	26
agenticworkflows	25
serena	15

mcp_fallback_count: 9 lockfiles used legacy allowed-tool-comment scraping instead of the gh-aw-manifest JSON.

Interesting findings

1. Job count per workflow jumped +28.8% (7.09 → 9.09 avg) while the lockfile count grew only 0.6% (344 → 346) — total jobs went from 2,441 to 3,145 (+704) in two days. This points to a new job being added broadly across existing workflows (e.g. a grader/evaluation job), not just new workflows being added.
2. That theory is corroborated by the timeout distribution: the 5-minute timeout bucket exploded from 2 → 696 occurrences in the same window — consistent with a uniform new job carrying a 5-minute default timeout, rolled out fleet-wide.
3. Union id-token: write jumped from 5 → 346 workflows (now literally all of them), while the agent job's own permissions still show only 4 workflows granting id-token: write. The new grant is coming from a different, non-agent job added across nearly the whole fleet — worth confirming this is an intentional OIDC requirement (e.g. attestation or publishing) rather than an over-broad default.
4. Discussion-category detection is automatic for 92/93 create_discussion workflows; only pr-sous-chef.lock.yml has an unresolved category. Among resolved ones, audits accounts for 85% (79/92) — overwhelmingly the dominant discussion category.
5. Four infra safe-outputs (noop, report_incomplete, report_missing_data, report_missing_tool) appear in 98% of lockfiles versus business outputs like create_pull_request (19%) or create_discussion (27%) — a clean signal that these four are compiler defaults, useful as a baseline when auditing which workflows deviate.

Historical trends (vs. 2026-10-19)

Metric	2026-10-19	2026-10-21	Δ
Lockfiles	344	346	+2
Total size	57.50 MB	61.77 MB	+4.27 MB (+7.4%)
Avg size	167.2 KB	178.5 KB	+6.8%
workflow_dispatch	335	336	+1
Total jobs	2,441	3,145	+704 (+28.8%)
Total steps	51,302	54,195	+2,893 (+5.6%)
Workflows with any write	342	346	+4 (now 100%)
create_discussion workflows	93	93	0

Recommendations

1. Confirm whether the fleet-wide id-token: write grant and the +704 job increase share a root cause (new compiled job template) — verify it's intentional before it becomes permanent baseline.
2. Resolve the one unresolved discussion category (pr-sous-chef.lock.yml) to reach 100% detection coverage.
3. Given audits dominates discussion categories (85%), review whether other categories need broader workflow coverage or consolidation.
4. Watch the newly-introduced 5-minute timeout bucket (696 occurrences) for jobs that may need longer timeouts under real load.

Methodology

Single-script compact JSON analysis: one Python pass over all .github/workflows/*.lock.yml files produced a single compact summary JSON, reasoned over without re-opening individual lockfiles.

References: §39669701288

Generated by 📊 Lockfile Statistics Analysis Agent · claude · agent · 65.4 AIC · ⌖ 0.807 AIC · ⊞ 6.6K · ◷

• expires on Oct 22, 2026, 12:30 PM UTC-08:00