[lockfile-stats] Lockfile Statistics Audit — 2026-10-22

[github-actions[bot]]

Overview

Daily lockfile statistics for .github/workflows/*.lock.yml — generated 2026-10-22.

Metric	Value
Lockfiles analyzed	346 (0 skipped/malformed)
Total size	58.9 MB (61,801,785 bytes)
Avg / min / max size	174.4 KB / 97.9 KB / 312.3 KB
Workflows with workflow_dispatch	336 (97.1%)
Engines detected	14 (0 unknown)
Safe-output config missing	1 lockfile

File size distribution

Sizes cluster tightly: min 100,227 B, avg 178,618 B, max 319,832 B — a ~3.2x spread, no outliers skewing the average.

Trigger analysis

Trigger counts and top combinations (346 workflows)

Trigger	Count
workflow_dispatch	336
schedule	251
pull_request	47
workflow_call	5
issues	5
issue_comment	3
push	2
deployment_status / workflow_run / discussion / discussion_comment / repository_dispatch / pull_request_review_comment	1 each

Trigger combination	Workflows	Share
schedule + workflow_dispatch	214	61.8%
workflow_dispatch only	72	20.8%
pull_request + schedule + workflow_dispatch	33	9.5%
pull_request + workflow_dispatch	9	2.6%
pull_request only	3	0.9%
other combos (6 variants)	15	4.3%

Most common cron: 0 0 */2 * * (every 2 days at midnight) — 60 workflows. The remaining ~190 scheduled workflows use mostly unique, staggered cron times.

Safe outputs analysis

Safe-output type usage (top 15 of 56 distinct types)

Type	Count
noop / report_incomplete / report_missing_data / report_missing_tool	339 each
create_report_incomplete_issue	338
create_issue	183
create_discussion	92
add_comment	74
create_pull_request	66
push_repo_memory	33
add_labels	32
upload_asset	26
mentions	24
create_pull_request_review_comment / submit_pull_request_review	16 each
upload_artifact	15
create_check_run	14

45 additional types appear 1-10 times each (long tail: Jira/Linear/Slack integrations, project field updates, etc.).

Discussion categories — 93 workflows configure create_discussion; 92 resolved a category (1 unresolved, see Findings).

Category	Count	Share of detected
audits	79	85.9%
announcements	5	5.4%
artifacts	2	2.2%
dev	2	2.2%
research	2	2.2%
general	1	1.1%
daily-news	1	1.1%

This report itself lands in audits, the dominant category.

Structural characteristics

Metric	Total	Max (single workflow)
Jobs	3,145	25
Steps	54,205	342
Script steps	22,340	99

Permission patterns

Derived from jobs.agent.permissions (not the always-empty top-level block):

Agent-job scopes (read/write/none across 346 workflows)

Scope	read	write
contents	346	0
pull-requests	255	0
issues	261	0
actions	139	0
discussions	52	0
security-events	15	0
vulnerability-alerts	2	0
models / packages / deployments / drives	1	0
copilot-requests	0	168
id-token	0	4

Agent jobs are almost universally least-privilege read-only — the only write scopes granted directly to the agent are copilot-requests (Copilot engine runs) and id-token (OIDC). Actual write access happens elsewhere: the union across all jobs in a workflow (including safe-output jobs) shows id-token write in all 346 workflows (100%) and issues write in 343 (99.1%), confirming gh-aw's safe-outputs isolation pattern — the agent reasons with read-only access, and a separate privileged job performs the writes.

Engine distribution

Engine	Count	Share
copilot	143	41.3%
codex	76	22.0%
claude	63	18.2%
pi	38	11.0%
aider / goose	4 each	1.2%
agy / opencode	3 each	0.9%
crush / cursor / deepseek-harness / gemini / kiro / pydantic-ai	2 each	0.6%

All 346 lockfiles resolved an engine (0 unknown).

Tool & MCP patterns

MCP server	Workflows using it
safeoutputs	317
github	192
work-queue	33
mcpscripts	26
agenticworkflows	25
serena	15
tavily / agy-native	3 each
sentry	2
graft / ast-grep / grafana / deepwiki / microsoftdocs	1 each

9 lockfiles required fallback (legacy comment-scraping) detection rather than the structured manifest.

Findings

1. Least-privilege by construction: agent jobs hold zero direct write permissions on contents, issues, or pull-requests in any of the 346 workflows — all writes flow through safe-output jobs, which is why the union view shows near-universal write access (id-token 100%, issues 99.1%) while the agent-job view shows none.
2. Engine diversity is real: Copilot leads at 41.3%, but claude + codex + pi combined account for ~51% of workflows — no single-engine monoculture.
3. One unresolved discussion category: pr-sous-chef.lock.yml configures create_discussion but its category could not be resolved from GH_AW_SAFE_OUTPUTS_CONFIG — worth a manual check (1.1% gap, within tolerance but notable since it's the only one).
4. One workflow has no safe-outputs config at all — likely a pure read-only/reporting workflow with no write surface; worth confirming it doesn't silently need one.
5. Trigger pattern dominance: 61.8% of workflows (214) use the schedule + workflow_dispatch pair, and a single cron (0 0 */2 * *, every 2 days) accounts for 60 of the 251 scheduled workflows — a meaningful clustering that could stagger better to smooth runner load.

Historical trends

Compared to the prior snapshot (2026-10-21):

Metric	2026-10-21	2026-10-22	Δ
Lockfile count	346	346	0
Total bytes	61,771,416	61,801,785	+30,369 (+0.05%)
Avg bytes	178,530.1	178,617.9	+87.8
Max bytes	319,556	319,832	+276
Total steps	54,195	54,205	+10
Total script steps	22,337	22,340	+3

Triggers, safe-output types, discussion categories, engine distribution, permission patterns, and MCP usage are unchanged day-over-day — the fleet is stable; only minor recompilation growth in a handful of lockfiles.

Recommendations

• Investigate pr-sous-chef.lock.yml's create_discussion config — category extraction failed where it succeeds for 92/93 peers.
• Confirm the 1 lockfile with no safe-outputs config is intentionally output-free.
• Consider staggering the 60 workflows sharing the 0 0 */2 * * cron to reduce simultaneous runner load.
• Re-run this audit after a few more days accumulate to get a multi-day trend line rather than single-day deltas.

Methodology

single-script compact JSON analysis

References:

• §39848211192

Generated by 📊 Lockfile Statistics Analysis Agent · claude · agent · ~55 AIC · ⌖ ~1 AIC · ⊞ 6.6K · ◷

• expires on Oct 23, 2026, 12:30 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Lockfile Statistics Analysis Agent.

A newer discussion is available at Discussion #71490.