[lockfile-stats] Lockfile Statistics Report — 2026-10-24

[github-actions[bot]]

Overview

Analysis of 348 compiled .github/workflows/*.lock.yml files as of 2026-10-24 (run §40129323018). All 348 lockfiles parsed successfully (0 skipped, 0 self-check errors).

Key metrics

Metric	Value
Lockfiles	348
Total size	62,434,502 bytes (~59.5 MiB)
Avg / min / max size	179,409 / 100,227 / 347,632 bytes
workflow_dispatch present	338 (97.1%)
schedule present	252 (72.4%)
create_discussion configured	93 workflows
Discussion category detected	92/93 (98.9%)
Engines detected	348/348 (0 unknown)
Agent-job permissions resolved	348/348 (0 unknown)

File size distribution

Sizes range from ~97.9 KiB to ~339.5 KiB, averaging ~175.2 KiB. No lockfiles were skipped as malformed.

Trigger analysis

Top trigger types: workflow_dispatch 338, schedule 252, pull_request 47, workflow_call 5, issues 5, issue_comment 3, push 2 (plus singletons: deployment_status, workflow_run, discussion, discussion_comment, repository_dispatch, pull_request_review_comment).

Top combinations: schedule+workflow_dispatch 215, workflow_dispatch alone 73, pull_request+schedule+workflow_dispatch 33, pull_request+workflow_dispatch 9.

Cron cadence is dominated by a shared 0 0 */2 * * (every 2h) slot used by 60 workflows; the remaining roughly 190 scheduled workflows are spread across distinct per-minute offsets, indicating deliberate stagger to avoid runner contention.

Safe outputs analysis

Baseline safe-output tools (noop, report_incomplete, report_missing_data, report_missing_tool) are present in 341/348 workflows (98%), confirming near-universal adoption of the safe-outputs contract. Beyond baseline: create_issue 184, create_discussion 92 configs resolved (93 workflows declare it), add_comment 74, create_pull_request 66, push_repo_memory 33, add_labels 32, upload_asset 26. Long tail includes Jira/Linear/Slack integration outputs (1 workflow each).

Discussion categories (92 resolved): audits 79, announcements 5, artifacts 2, dev 2, research 2, general 1, daily-news 1.

Detection status: create_discussion_workflows=93 which is greater than 0, so discussion-producing workflows do exist (this is not the no-workflows-configured case). 92 of 93 categories resolved; one workflow could not be resolved via JSON or regex fallback. The gap (1.1%) is below the 10% failure threshold, so this is treated as a known per-workflow data quirk rather than a systemic extraction failure. safe_outputs_config_missing=0 — the GH_AW_SAFE_OUTPUTS_CONFIG env var was found in every lockfile.

Structural characteristics

	Avg	Max	Total
Jobs per workflow	9.08	25	—
Steps per workflow	156.4	342	54,430
Script steps per workflow	108.1	195	37,622

Permission patterns

Permissions below reflect the compiled jobs.agent.permissions block (not the always-empty top-level permissions: {}), resolved for all 348 workflows:

Scope	read	write	none
contents	348	0	0
issues	261	0	87
pull-requests	255	0	93
actions	141	0	207
discussions	52	0	296
security-events	15	0	333
id-token	0	4	344

The agent job itself is essentially read-only everywhere except id-token — writes flow through the safe-outputs mechanism in separate jobs, not the agent job directly. Confirming this, the union across all jobs per workflow shows widespread write grants elsewhere: id-token write in 348/348, issues write in 345/348, contents write in 232/348, copilot-requests write in 171/348, pull-requests write in 153/348, discussions write in 97/348.

Engine distribution

(from gh-aw-metadata agent_id, 0 unknown)

Engine	Count
copilot	145
codex	76
claude	63
pi	38
aider	4
goose	4
agy	3
opencode	3
crush	2
cursor	2
deepseek-harness	2
gemini	2
kiro	2
pydantic-ai	2

copilot is the plurality engine (41.7%), followed by codex (21.8%) and claude (18.1%).

Tool and MCP patterns

MCP server usage (parsed from gh-aw-manifest, 0 fallback-to-regex needed): safeoutputs 348 (universal), github 208, agenticworkflows 44, work-queue 37, mcpscripts 33, serena 24, tavily 5, sentry 5, agy-native 3, grafana 3, ast-grep 2, datadog 2, deepwiki 2, microsoftdocs 2, plus single-use servers (kreuzberg, graft, agentdb).

Interesting findings

1. Universal OIDC and safe-outputs adoption: every single workflow (348/348) grants id-token: write somewhere and uses the safeoutputs MCP server — the safe-outputs architecture is fully rolled out, with zero legacy or bypass workflows.
2. Agent jobs are write-free by design: across all 12 tracked permission scopes, the agent job never holds write except id-token (4 workflows) — writes are strictly delegated to downstream jobs, a strong isolation pattern.
3. Heavy clustering on one cron slot: 60 workflows (17% of all lockfiles) share the exact 0 0 */2 * * cadence, while the rest are deliberately staggered to unique minute/hour offsets, suggesting intentional scheduling discipline to avoid runner thundering-herd effects.
4. Copilot is the plurality engine: copilot alone (145) is the largest single engine at 41.7% of all workflows, ahead of codex and claude individually, though codex plus claude combined (139) still trails copilot only slightly.
5. Audits category dominates discussions: of 92 resolved discussion categories, 79 (86%) post to audits — this very report lands in the same category, reflecting that most discussion-producing workflows are self-monitoring or audit agents rather than user-facing announcements.

Historical trends (vs. 2026-10-21, 3 days prior)

Metric	2026-10-21	2026-10-24	Delta
Lockfiles	346	348	+2
Total bytes	61,771,416	62,434,502	+663,086 (+1.1%)
Max size	319,556	347,632	+28,076 (+8.8%)
workflow_dispatch count	336	338	+2
schedule count	251	252	+1
create_discussion workflows	93	93	flat
copilot engine	143	145	+2
codex / claude / pi engines	76 / 63 / 38	76 / 63 / 38	flat

The two new workflows both run on the copilot engine. The largest single lockfile grew about 8.8% since 2026-10-21 and is worth a spot-check if that trend continues. MCP server-usage counts rose markedly (for example github 192 to 208, agenticworkflows 25 to 44, serena 15 to 24) alongside the prior run fallback-regex count dropping from 9 to 0; this is at least partly a methodology improvement in the v4 analyzer manifest-based MCP parsing (less reliance on the regex fallback) rather than a pure usage trend, so treat the magnitude with some caution.

Recommendations

• Investigate the single workflow with an unresolved create_discussion category (98.9% detection rate) to close the last gap, even though it is below the alerting threshold.
• Spot-check the lockfile that grew to 347,632 bytes (new max) for unexpected bloat such as duplicated steps or inlined scripts.
• Review whether 87 workflows with issues: none and 93 with pull-requests: none at the agent-job level reflect intentional scoping, given 345/348 and 153/348 workflows respectively grant write access to those scopes somewhere in the job graph.
• No malformed lockfiles were found this run; continue tracking skipped_malformed over time as a compiler-health signal.

Methodology note

Single-script compact JSON analysis. All metrics computed in one pass over 348 lockfiles by /tmp/gh-aw/cache-memory/scripts/lockfile_stats_v4.py, persisted to cache-memory for reuse across runs; summary JSON (6.9 KB) read once for this report. Engine IDs sourced from the # gh-aw-metadata header comment; safe-output config and discussion categories sourced from the GH_AW_SAFE_OUTPUTS_CONFIG env JSON; MCP servers sourced from the # gh-aw-manifest header comment (0 fallback parses needed this run).

References:

• §40129323018

Generated by 📊 Lockfile Statistics Analysis Agent · claude · agent · ~63 AIC · ⌖ ~1 AIC · ⊞ 4.3K · ◷

• expires on Oct 25, 2026, 12:29 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Lockfile Statistics Analysis Agent.

A newer discussion is available at Discussion #71948.