[lockfile-stats] Lockfile Statistics Analysis — 2026-10-30

[github-actions[bot]]

Executive summary

• 353 compiled lockfiles analyzed (+4 vs 2026-10-28), 0 skipped as malformed.
• Total size: 63.5 MB (avg 180 KB, min 100.5 KB, max 353.7 KB).
• Methodology: single-script compact JSON analysis.

File size distribution

Metric	Value
Count	353
Avg	180,009 bytes
Min	100,543 bytes
Max	353,668 bytes
Total	63,543,042 bytes

Trigger analysis

Trigger	Count
workflow_dispatch	343
schedule	255
pull_request	47
workflow_call	5
issues	5
issue_comment	3
push	2
discussion / discussion_comment / repository_dispatch / workflow_run / deployment_status / pull_request_review_comment	1 each

Top combinations: schedule+workflow_dispatch (218), workflow_dispatch only (75), pull_request+schedule+workflow_dispatch (33).

Most common cron: 0 0 */2 * * (every 2 days) — 63 workflows, far ahead of the next most common (3 workflows on 7 5 * * *).

Safe outputs analysis

Top safe-output types (excluding universal noop/report_* scaffolding present in ~346 workflows):

Type	Count
create_issue	178
create_discussion	93
create_pull_request	77
add_comment	74
push_repo_memory	32
add_labels	32
upload_asset	26

Discussion category detection: 94 workflows configure create_discussion; category resolved for 93 of them (99%, within the 10% tolerance — not a detection failure). Resolved categories:

Category	Count
audits	80
announcements	5
artifacts	2
dev	2
research	2
general	1
daily-news	1

safe_outputs_config_missing: 0 (config found in every lockfile). This workflow's own discussion lands in audits, the dominant category.

Structural characteristics

Metric	Avg	Max
Jobs/workflow	9.1	25
Steps/workflow	157.1	343
Script steps/workflow	108.8	196

Totals: 55,439 steps and 38,409 script (run:) steps across all lockfiles.

Timeout distribution (minutes): 5→710, 10→390, 60→342, 15→268, 45→83 (long tail out to 300).

Permission patterns (agent job)

Scope	read	write	none
contents	353	0	0
issues	262	0	91
pull-requests	256	0	97
actions	142	0	211
discussions	52	0	301
security-events	15	0	338
id-token	0	4	349

No agent job in the sample grants direct write beyond id-token — consistent with the safe-outputs pattern where writes happen in separate, privilege-escalated jobs. Unknown/unresolved permission blocks: 0.

Union-of-all-jobs write grants (where any job in the workflow holds write): id-token 353, issues 350, copilot-requests 174, contents 235, pull-requests 162, actions 144, discussions 98.

Engine distribution

(from gh-aw-metadata agent_id, 0 unknown)

Engine	Count
copilot	145
codex	78
claude	64
pi	38
aider	4
goose	4
agy / opencode	3 each
crush / cursor / deepseek-harness / factory / gemini / kiro / pydantic-ai	2 each

Tool & MCP patterns

Top MCP servers in use: safeoutputs (353, universal), github (211), agenticworkflows (44), work-queue (38), mcpscripts (34), serena (24), tavily/sentry (5 each).

Interesting findings

1. copilot is the plurality engine (41% of workflows) but claude+codex+pi combined (180) outnumber it — the fleet is multi-engine, not copilot-dominated.
2. Biweekly scheduling dominates: 0 0 */2 * * alone accounts for 25% of all schedule triggers, suggesting a shared template rather than organically chosen cadences.
3. Zero direct-write agent jobs: every one of the 353 agent jobs is read-only at the job-permission level; all writes are deferred to safe-output-handling jobs, confirming consistent adoption of the safe-outputs isolation pattern repo-wide.
4. factory engine newly appeared this run (2 workflows) — not present in the 2026-10-28 snapshot.
5. Discussion-producing workflows overwhelmingly target the audits category (80/93, 86%), matching this very workflow's own output.

Historical trends (vs 2026-10-28)

Metric	2026-10-28	2026-10-30	Δ
Lockfiles	349	353	+4
Total bytes	62,818,956	63,543,042	+724,086
codex engine	77	78	+1
claude engine	63	64	+1
create_issue safe output	174	178	+4
create_discussion_workflows	94	94	0

Recommendations

• Consider consolidating the many singleton cron schedules onto the dominant 0 0 */2 * * cadence where staggering is not load-bearing, to simplify audit review.
• The one workflow with an unresolved create_discussion category (94 configured vs 93 resolved) is worth a manual check to confirm it intentionally omits a category.
• Continue monitoring engine mix as new engines (factory) onboard, to catch config drift early.

Methodology note

single-script compact JSON analysis

Generated by 📊 Lockfile Statistics Analysis Agent · claude · agent · ~44 AIC · ⌖ ~1 AIC · ⊞ 4.3K · ◷

• expires on Oct 31, 2026, 12:24 PM UTC-08:00