[lockfile-stats] Lockfile Statistics Report — 2026-10-23

[github-actions[bot]]

Executive Summary

• 348 lockfiles compiled (.github/workflows/*.lock.yml), 0 skipped as malformed
• Total size: 62,423,559 bytes (~59.5 MB); avg 179,378 bytes (~175 KB) per file
• Size range: 100,227 – 347,632 bytes
• Run: §40018732143

File Size Distribution

Metric	Value
Count	348
Total	62,423,559 bytes (59.5 MB)
Avg	179,378 bytes (175.2 KB)
Min	100,227 bytes
Max	347,632 bytes

Trigger Analysis

Trigger	Count	% of workflows
workflow_dispatch	338	97.1%
schedule	252	72.4%
pull_request	47	13.5%
workflow_call	5	1.4%
issues	5	1.4%
issue_comment	3	0.9%
push	2	0.6%
others (deployment_status, workflow_run, discussion, discussion_comment, repository_dispatch, pull_request_review_comment)	1 each	0.3%

Top trigger combinations: schedule+workflow_dispatch 215 (61.8%), workflow_dispatch only 73 (21.0%), pull_request+schedule+workflow_dispatch 33 (9.5%), pull_request+workflow_dispatch 9 (2.6%).

Most common cron: 0 0 */2 * * (every 2 days) — 60 workflows (17.2%), by far the most concentrated schedule in the fleet.

Safe Outputs Analysis

Baseline scaffolding (noop, report_incomplete, report_missing_data, report_missing_tool) appears in ~341/348 workflows (98%) — effectively universal.

Most common write-producing actions: create_issue 184 (52.9%), create_discussion 92 (26.4%), add_comment 74 (21.3%), create_pull_request 66 (19.0%), push_repo_memory 33, add_labels 32.

Long tail: 50+ distinct safe-output types, many used by just 1-2 workflows (Jira/Linear/Slack integrations, project field updates, code-scanning alerts).

Discussion categories (93 workflows configure create_discussion; 92 resolved — no detection failure, see Methodology):

Category	Count
audits	79
announcements	5
artifacts	2
dev	2
research	2
general	1
daily-news	1

1 workflow (pr-sous-chef.lock.yml) has an unresolved category — well under the 10% failure threshold, so this is a known gap, not a broken extractor.

Structural Characteristics

Metric	Total	Avg/workflow	Max
Jobs	3,159	9.1	25
Steps	54,420	156.4	342
Script steps	22,427	64.4	99

Script steps make up ~41% of all steps fleet-wide.

Permission Patterns

Agent-job permissions (the primary per-workflow scope, mirroring frontmatter permissions:) are read-only by design: contents read 100%, issues read 75%, pull-requests read 73%, actions read 41%, discussions read 15%. The only direct grants on the agent job are copilot-requests write (171, 49%) and id-token write (4) — zero agent jobs hold write on contents, issues, pull-requests, or discussions.

Union across all jobs in a workflow (including safe-output jobs) tells the complementary story: id-token write in 100% of workflows (OIDC), issues write 99%, contents write 67%, copilot-requests write 49%, pull-requests write 44%, discussions write 28%. 348/348 workflows (100%) grant a write scope somewhere — confirming the safe-outputs job-isolation pattern: the agent job stays read-only, and a separate job performs the actual write.

Engine Distribution

Engine	Count	%
copilot	145	41.7%
codex	76	21.8%
claude	63	18.1%
pi	38	10.9%
aider	4	1.1%
goose	4	1.1%
agy	3	0.9%
opencode	3	0.9%
crush / cursor / deepseek-harness / gemini / kiro / pydantic-ai	2 each	0.6% each

engine_unknown = 0 — fully resolved for all 348 lockfiles via gh-aw-metadata comments.

Tool & MCP Patterns

MCP server	Workflows
safeoutputs	319
github	194
work-queue	35
mcpscripts	26
agenticworkflows	25
serena	15
others (agy-native, tavily, sentry, graft, ast-grep, grafana, deepwiki, microsoftdocs)	1-3 each

9 lockfiles lacked a gh-aw-manifest mcp_servers array and required the legacy # - mcp__... comment fallback.

Interesting Findings

1. Universal permission isolation: 0/348 workflows grant write directly to the agent job on any scope — every single compiled workflow routes writes through a separate job.
2. Copilot leads the engine mix at 41.7%, ahead of codex (21.8%) and claude (18.1%).
3. Schedule concentration: 60 workflows (17.2%) share the identical 0 0 */2 * * cron — the most clustered single schedule in the fleet.
4. Discussion-category detection is effectively complete (92/93, 98.9%); only pr-sous-chef.lock.yml is unresolved, well inside the 10% tolerance.
5. Script-heavy workflows: script steps account for ~41% of all steps fleet-wide (22,427 of 54,420).

Historical Trends (vs 2026-10-21)

Metric	2026-10-21	2026-10-23	Δ
Lockfiles	346	348	+2
Total bytes	61,771,416	62,423,559	+652,143 (+1.06%)
Max size	319,556	347,632	+28,076
workflow_dispatch	336	338	+2
Total jobs	3,145	3,159	+14
Total steps	54,195	54,420	+225
Script steps	22,337	22,427	+90
copilot engine	143	145	+2
create_issue	183	184	+1
dispatch_workflow	9	10	+1
MCP: safeoutputs	317	319	+2
MCP: github	192	194	+2

The 2 new lockfiles both resolve to the copilot engine and account for essentially all of the period's growth in jobs/steps/MCP usage — no shift in the rest of the engine mix.

Recommendations

• Investigate the one unresolved discussion category (pr-sous-chef.lock.yml) to confirm whether it's genuinely missing a category or uses a non-standard config shape.
• Consider staggering the 60 workflows currently sharing the 0 0 */2 * * cron, if their tasks don't require synchronized runs, to smooth runner load.
• The long tail of 50+ single-use safe-output types (Jira/Linear/Slack/project-field integrations) suggests documenting or templating them as reusable integration add-ons rather than one-off configs.

Methodology

single-script compact JSON analysis. Engine resolved from gh-aw-metadata header comments; permissions from per-job permissions: blocks (never the always-empty top-level block); safe-output config and discussion categories from GH_AW_SAFE_OUTPUTS_CONFIG/GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG env JSON, parsed via yaml.safe_load + json.loads (no regex fallback was needed this run). create_discussion_workflows=93 > 0 and discussion_category_detected=92 > 0 (not a zero-detection failure); the 1-workflow gap is 1.1%, under the 10% self-check threshold.

References:

• §40018732143

Generated by 📊 Lockfile Statistics Analysis Agent · claude · agent · ~65 AIC · ⌖ ~1 AIC · ⊞ 6.6K · ◷

• expires on Oct 24, 2026, 12:31 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Lockfile Statistics Analysis Agent.

A newer discussion is available at Discussion #71706.