[lockfile-stats] Lockfile Statistics Audit — 2026-10-28

[github-actions[bot]]

Overview

Analyzed all 349 compiled .github/workflows/*.lock.yml files (0 skipped, 0 parse errors). Total compiled size: 62,818,956 bytes (~59.9 MiB), avg 179,997 B, min 100,543 B, max 347,824 B.

Key metrics

Metric	Value
Lockfiles	349
Total size	62,818,956 B (~59.9 MiB)
Avg / Min / Max size	179,997 / 100,543 / 347,824 B
workflow_dispatch enabled	339 (97.1%)
schedule enabled	253 (72.5%)
Avg jobs / steps / scripts per workflow	9.07 / 157.3 / 109.0
Max jobs / steps / scripts	25 / 343 / 196
Engines resolved	349/349 (0 unknown)
Agent-job permissions resolved	349/349 (0 unknown)

Trigger analysis

Trigger	Count
workflow_dispatch	339
schedule	253
pull_request	47
workflow_call	5
issues	5
issue_comment	3
push	2
deployment_status / workflow_run / discussion / discussion_comment / repository_dispatch / pull_request_review_comment	1 each

Top trigger combinations: schedule+workflow_dispatch 216 (61.9%), workflow_dispatch only 73 (20.9%), pull_request+schedule+workflow_dispatch 33, pull_request+workflow_dispatch 9, pull_request only 3.

Cron schedules are highly varied (89 distinct patterns); the dominant single cadence is 0 0 */2 * * (every 2 days) at 61 occurrences — everything else is 1-3 occurrences, mostly unique daily/weekday times, indicating schedules are deliberately staggered rather than bunched.

Safe outputs analysis

Universal safe outputs (present in ~342-349/349 workflows as baseline infra): noop, report_incomplete, report_missing_data, report_missing_tool (342 each), create_report_incomplete_issue (341).

Top non-universal safe output types:

Type	Count
create_issue	174
create_discussion	93
create_pull_request	77
add_comment	74
push_repo_memory	32
add_labels	32
upload_asset	26
mentions	24
create_pull_request_review_comment / submit_pull_request_review	16 each
upload_artifact	15
create_check_run	14

Discussion categories (94 workflows configure create_discussion; 93 categories resolved, 1 unresolved — a 1.06% gap, within the self-check's 10% tolerance, so this is reported as a minor detection gap rather than a failure):

Category	Count
audits	80
announcements	5
artifacts	2
dev	2
research	2
general	1
daily-news	1

safe_outputs_config_missing: 0 — every lockfile exposed a parseable GH_AW_SAFE_OUTPUTS_CONFIG. discussion_category_fallback_parsed: 0 — no regex fallback was needed.

Structural characteristics

• Jobs per workflow: avg 9.07 (min 6, max 25)
• Steps per workflow: avg 157.3 (max 343, total 54,905 across all lockfiles)
• Embedded scripts per workflow: avg 109.0 (max 196, total 38,029)
• Step-level timeout-minutes distribution (top values): 5 min ×702, 10 min ×387, 60 min ×338, 15 min ×264, 45 min ×83

Permission patterns (agent job, not the always-empty top-level block)

jobs.agent.permissions by scope (read / write / none across 349 workflows):

Scope	Read	Write	None
contents	349	0	0
issues	261	0	88
pull-requests	255	0	94
actions	141	0	208
discussions	52	0	297
security-events	15	0	334
packages	1	0	348
deployments	1	0	348
id-token	0	4	345
checks / statuses / pages	0	0	349

Notably, the agent job never holds write on contents, issues, or pull-requests in any workflow — all 0 write. Actual writes are delegated to dedicated safe-output jobs, visible in the union-of-all-jobs view:

union_job_permissions_write_count: id-token 349, issues 346, contents 234, copilot-requests 172, pull-requests 162, discussions 98, actions 143, checks 14, security-events 3, others ≤2.

Engine distribution

(from gh-aw-metadata agent_id, 0 unresolved)

Engine	Count	Share
copilot	145	41.5%
codex	77	22.1%
claude	63	18.1%
pi	38	10.9%
aider / goose	4 each	1.1%
agy / opencode	3 each	0.9%
crush / cursor / deepseek-harness / gemini / kiro / pydantic-ai	2 each	0.6%

Top agent models: copilot/auto (15), copilot/gpt-5 (12), copilot/claude-haiku-5.5 (7), with a long tail (9 distinct models tied at 6 each).

Tool & MCP patterns

MCP server	Workflows
safeoutputs	349 (100%)
github	208 (59.6%)
agenticworkflows	44
work-queue	37
mcpscripts	33
serena	24
tavily / sentry	5 each
agy-native / grafana	3 each
ast-grep / datadog / deepwiki / microsoftdocs	2 each

mcp_fallback_count: 0 — all server data came from the gh-aw-manifest JSON, no legacy comment-scraping needed. Note: mcp_tool_counts came back empty this run — server-level usage is captured but per-tool granularity isn't yet populated by the analyzer; a future script revision could add this if needed.

Interesting findings

1. Write isolation is universal: the agent job holds 0 write permissions on contents/issues/pull-requests across all 349 workflows — every write goes through dedicated safe-output jobs (contents write appears in 234 workflows only at the union level).
2. workflow_dispatch is near-ubiquitous (339/349, 97.1%) while schedule covers 72.5% — schedule+workflow_dispatch alone accounts for 62% of all workflows.
3. create_issue (174) is nearly double create_discussion (93) as the leading non-universal safe output; audits dominates discussion categories (80/93, 86%).
4. Engine adoption is copilot-led (41.5%) but codex (22.1%) and claude (18.1%) together account for 40% of workflows, with 10 other engines in a long tail (≤4 workflows each).
5. Cron scheduling is deliberately staggered: 89 distinct cron patterns, with only one cadence (0 0 */2 * *) repeated more than 3 times (61 occurrences) — avoids thundering-herd scheduling.

Historical trends (vs. 2026-10-27)

Metric	2026-10-27	2026-10-28	Delta
Lockfiles	349	349	0
Total bytes	62,815,057	62,818,956	+3,899 (+0.006%)
Max size	347,716	347,824	+108
Trigger/safe-output/engine/permission/MCP distributions	—	—	unchanged

All categorical distributions (triggers, safe outputs, discussion categories, engines, permissions, MCP servers) are byte-for-byte identical day over day — only a routine recompile occurred, with no structural or feature changes to the workflow set.

Recommendations

• The single unresolved create_discussion category (1/94) is within tolerance but worth a one-off look to confirm it's a default-category workflow rather than a parser edge case.
• Consider populating mcp_tool_counts in a future analyzer revision (lockfile_stats_v5.py) if per-tool MCP usage becomes relevant to future audits.
• Current write-isolation pattern (0 write permissions in agent jobs) looks consistent and worth preserving as new workflows are added.

Methodology

Single-script compact JSON analysis — one cached Python analyzer (lockfile_stats_v4.py) parsed all 349 lockfiles in one pass via yaml.safe_load, extracting gh-aw-metadata/gh-aw-manifest comments and GH_AW_SAFE_OUTPUTS_CONFIG env JSON, producing a compact summary consumed in a separate turn.

References:

• §40761961022

Generated by 📊 Lockfile Statistics Analysis Agent · claude · agent · ~37 AIC · ⌖ ~1 AIC · ⊞ 4.3K · ◷

• expires on Oct 29, 2026, 12:24 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Lockfile Statistics Analysis Agent.

A newer discussion is available at Discussion #73035.