[lockfile-stats] Lockfile Statistics Audit — 2026-10-27 (349 workflows)

[github-actions[bot]]

Executive Summary

• 349 compiled lockfiles analyzed, totaling ~59.9 MiB (62,815,057 bytes); avg 175.8 KiB (179,985.8 bytes), range 98.2 KiB – 339.6 KiB.
• Day-over-day vs 2026-10-26: lockfile count unchanged; notable shift from create_issue toward create_pull_request, and from 15-min to 45-min job timeouts on 11 jobs (see Historical Trends).
• Run: §40576731850

File Size Distribution

Metric	Value
Count	349
Total	62,815,057 bytes (~59.9 MiB)
Average	179,985.8 bytes (~175.8 KiB)
Min	100,543 bytes (~98.2 KiB)
Max	347,716 bytes (~339.6 KiB)

Trigger Analysis

Trigger	Workflows
workflow_dispatch	339 (97.1%)
schedule	253 (72.5%)
pull_request	47
workflow_call	5
issues	5
issue_comment	3
push	2
deployment_status / workflow_run / discussion / discussion_comment / repository_dispatch / pull_request_review_comment	1 each

Top combinations: schedule+workflow_dispatch (216), workflow_dispatch only (73), pull_request+schedule+workflow_dispatch (33), pull_request+workflow_dispatch (9).

Cron frequency detail

Most schedules use unique per-workflow offsets to avoid thundering-herd collisions; the only widely shared slot is 0 0 */2 * * (every 2 days, 61 workflows). The remaining 90+ distinct cron expressions each occur only 1-3 times.

Safe Outputs Analysis

Near-universal boilerplate safe outputs: noop, report_incomplete, report_missing_data, report_missing_tool (342/349 each), create_report_incomplete_issue (341/349).

Safe output	Workflows
create_issue	174
create_discussion	93
create_pull_request	77
add_comment	74
push_repo_memory	32
add_labels	32
upload_asset	26
mentions	24
create_pull_request_review_comment / submit_pull_request_review	16 each
upload_artifact	15
create_check_run	14

Plus a long tail of ~45 niche integrations (Jira, Linear, Slack, code-scanning alerts, project updates, etc.), each used by 1-4 workflows.

Discussion categories — 94 workflows configure create_discussion; 93 resolved a category (safe_outputs_config_missing = 0, config found in every lockfile):

Category	Count
audits	80
announcements	5
artifacts	2
dev	2
research	2
general	1
daily-news	1

This is successful detection with one unresolved edge case, not a parsing failure: the gap (1/94, 1.1%) is well within the 10% tolerance threshold. The analyzer's own conservative status flag reads partial_or_failed whenever the gap is nonzero, even though this case passes the self-check.

Structural Characteristics

Metric	Avg	Min/Max	Total
Jobs/workflow	9.1	6 / 25	—
Steps/workflow	157.3	— / 343	54,905
Run-script steps/workflow	109.0	— / 196	38,029

Permission Patterns

Agent-job permissions (the effective per-workflow grant — the top-level permissions: {} block is always empty and carries no signal):

Scope	Read	Write	None
contents	349	0	0
issues	261	0	88
pull-requests	255	0	94
actions	141	0	208
discussions	52	0	297
security-events	15	0	334
id-token	0	4	345
packages / deployments	1	0	348
checks / statuses / pages	0	0	349

agent_job_permissions_unknown = 0 — every lockfile's agent-job permissions resolved. The agent job itself essentially never holds write permissions directly (only 4 workflows grant id-token: write there) — mutating effects route through safe-outputs in a separate job. Union-across-jobs write grants confirm this: id-token write in all 349 workflows, issues write in 346, contents write in 234, pull-requests write in 162, discussions write in 98.

Engine Distribution

Engine	Workflows
copilot	145 (41.5%)
codex	77 (22.1%)
claude	63 (18.1%)
pi	38 (10.9%)
aider / goose	4 each
agy / opencode	3 each
crush / cursor / deepseek-harness / gemini / kiro / pydantic-ai	2 each

engine_unknown = 0 — every lockfile's engine resolved from its gh-aw-metadata header.

Tool & MCP Patterns

MCP server	Workflows
safeoutputs	349
github	208
agenticworkflows	44
work-queue	37
mcpscripts	33
serena	24
tavily / sentry	5 each
agy-native / grafana	3 each

Tool-level granularity (mcp_tool_counts) was empty this run with zero fallback parses — the gh-aw-manifest entries for this lockfile set list servers but not per-tool detail, not a parsing failure.

Interesting Findings

1. Write access is centralized: the agent job almost never holds direct write permissions (only id-token in 4 cases); instead 349/349 workflows grant id-token: write to a separate safe-outputs job — a consistent least-privilege pattern across the entire fleet.
2. Copilot dominates engine choice (41.5%), but the fleet is otherwise diverse — 14 distinct engines in active use, with zero unresolved.
3. create_pull_request grew sharply day-over-day (66→77, +16.7%) while create_issue shrank (185→174, −5.9%) — consistent with workflows migrating from issue-based to PR-based output.
4. Timeout policy is shifting: 11 jobs moved from a 15-minute to a 45-minute timeout between 2026-10-26 and 2026-10-27 — worth confirming this is an intentional capacity increase rather than jobs masking slow steps.
5. Discussion-category detection has a 1-workflow gap (93/94, consistent with yesterday's 92/93) — a stable, minor, not-worsening gap.

Historical Trends (vs 2026-10-26)

Metric	2026-10-26	2026-10-27	Δ
Lockfiles	349	349	0
Total bytes	62,736,235	62,815,057	+78,822
create_issue	185	174	−11
create_pull_request	66	77	+11
create_discussion	92	93	+1
discussion_categories.audits	79	80	+1
Jobs w/ 15-min timeout	275	264	−11
Jobs w/ 45-min timeout	72	83	+11
Union pull-requests write	153	162	+9
Union contents write	232	234	+2
Union discussions write	97	98	+1

Engine distribution and MCP server usage were unchanged day-over-day.

Recommendations

• Investigate the single unresolved create_discussion category (93/94) to close the detection gap.
• Confirm the 11-job 15→45 minute timeout migration is intentional; audit for jobs masking slow/unstable steps rather than genuinely needing more time.
• Track the create_issue → create_pull_request migration (+11/−11 in one day) — if intentional, consider documenting it as the recommended pattern for new workflows.

Methodology

Single-script compact JSON analysis: one cached Python analyzer (scripts/lockfile_stats_v4.py) parses all .github/workflows/*.lock.yml files once via yaml.safe_load, extracts engine from gh-aw-metadata, permissions from per-job permissions: blocks, and safe-output/discussion-category config from GH_AW_SAFE_OUTPUTS_CONFIG, then writes a compact JSON summary used for all reasoning in this report.

References:

• §40576731850

Generated by 📊 Lockfile Statistics Analysis Agent · claude · agent · ~54 AIC · ⌖ ~1 AIC · ⊞ 4.3K · ◷

• expires on Oct 28, 2026, 12:27 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Lockfile Statistics Analysis Agent.

A newer discussion is available at Discussion #72749.