[lockfile-stats] Lockfile Statistics Analysis — 2026-10-25

[github-actions[bot]]

Executive summary

Analyzed all 348 compiled lockfiles (.github/workflows/*.lock.yml) in this repo on 2026-10-25. Total size 62,422,837 bytes (~59.5 MB), avg 175.2 KB, min 97.9 KB, max 339.1 KB. 0 malformed/skipped files.

File size distribution

Metric	Value
Count	348
Total	62,422,837 bytes
Average	179,376 bytes
Min	100,227 bytes
Max	347,272 bytes

Trigger analysis

Top triggers: workflow_dispatch (338), schedule (252), pull_request (47), workflow_call (5), issues (5).

Top combinations: schedule+workflow_dispatch (215), workflow_dispatch only (73), pull_request+schedule+workflow_dispatch (33), pull_request+workflow_dispatch (9).

Scheduling is dominated by a single cadence: 0 0 */2 * * (every 2 hours) appears in 60 workflows — by far the most common cron; the remaining ~90 distinct cron expressions are mostly unique daily/weekday schedules.

Safe outputs analysis

Universal infra outputs appear on nearly every workflow: noop/report_incomplete/report_missing_data/report_missing_tool (341 each), create_report_incomplete_issue (340).

Most common content-producing outputs:

Type	Count
create_issue	184
create_discussion	92
add_comment	74
create_pull_request	66
push_repo_memory	33
add_labels	32
upload_asset	26

Discussion categories (from create_discussion.category, 93 workflows configure create_discussion, category resolved for 92/93 — 1 unresolved, within the 10% tolerance so this is reported, not a hard failure):

Category	Count
audits	79
announcements	5
artifacts	2
dev	2
research	2
general	1
daily-news	1

safe_outputs_config_missing: 0 — config was found for every lockfile.

Structural characteristics

Metric	Avg	Max	Total
Jobs/workflow	9.1	25	—
Steps/workflow	156.4	342	54,430
Scripts/workflow	108.1	195	37,622

Permission patterns

From jobs.agent.permissions (not the always-empty top-level block):

Scope	read	write	none
contents	348	0	0
issues	261	0	87
pull-requests	255	0	93
actions	141	0	207
discussions	52	0	296
security-events	15	0	333
id-token	0	4	344

The agent job itself never carries write scopes beyond id-token (4 workflows) — consistent with the safe-outputs pattern where writes happen in a separate, narrowly-scoped downstream job. Looking at the union across all jobs per workflow, write access is far more common: issues write in 345/348, id-token write in all 348, contents write in 232, discussions write in 97, pull-requests write in 153.

agent_job_permissions_unknown: 0 — all 348 resolved.

Engine distribution

(from gh-aw-metadata agent_id, 0 unknown)

Engine	Count
copilot	145
codex	76
claude	63
pi	38
aider	4
goose	4
agy	3
opencode	3
crush / cursor / deepseek-harness / gemini / kiro / pydantic-ai	2 each

copilot and codex together account for ~64% of all workflows.

Tool & MCP patterns

MCP server usage: safeoutputs (348 — universal), github (208), agenticworkflows (44), work-queue (37), mcpscripts (33), serena (24), tavily (5), sentry (5). 0 workflows required the legacy comment-scraping fallback.

Interesting findings

1. Bi-hourly cron dominance: a single cron (0 0 */2 **) covers 60 workflows (~17% of the fleet) — far more than any other schedule.
2. Safe-outputs write isolation: the agent job almost never holds a write permission (only id-token in 4 cases), while unioned job permissions show 345/348 workflows ultimately writing issues — confirming the two-stage execute/write job split is the near-universal pattern.
3. Engine concentration: copilot + codex + claude cover 84% of workflows; the remaining 12 engines each appear in ≤4% of workflows.
4. Discussion audits dominate: of 92 resolved create_discussion categories, 79 (86%) target audits — this workflow's own output category.
5. Near-zero drift since last run: structural metrics (triggers, safe outputs, permissions, engine mix) are byte-for-byte identical to 2026-10-24; only total/max lockfile size shrank slightly (see trends below).

Historical trends (vs. 2026-10-24)

Metric	2026-10-24	2026-10-25	Δ
Lockfile count	348	348	0
Total bytes	62,434,502	62,422,837	-11,665
Avg size	179,409	179,376	-33
Max size	347,632	347,272	-360
create_discussion workflows	93	93	0
Engine distribution	identical	identical	—
Permission distribution	identical	identical	—

No structural changes detected day-over-day; only minor lockfile byte-size reduction (likely a small template/comment trim in recompilation), with trigger counts, safe-output types, permissions, and engine mix unchanged.

Recommendations

• Consider consolidating the 60 workflows on the identical 0 0 */2 * * cron if they don't need to run in lockstep, to spread scheduled-runner load.
• The 1 unresolved create_discussion category (of 93) is within tolerance but worth a one-off look to confirm it's an intentional default case rather than a config gap.
• Continue monitoring size trend; the current run shows a small, benign decrease — watch for larger jumps that could signal lockfile bloat.

Methodology note

single-script compact JSON analysis

Generated by 📊 Lockfile Statistics Analysis Agent · claude · agent · ~34 AIC · ⌖ ~1 AIC · ⊞ 4.3K · ◷

• expires on Oct 26, 2026, 12:26 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Lockfile Statistics Analysis Agent.

A newer discussion is available at Discussion #72174.