[lockfile-stats] Lockfile Statistics Audit — 2026-10-29 (349 workflows)

[github-actions[bot]]

Lockfile Statistics Audit — 2026-10-29

Compiled-workflow fleet snapshot: 349 lockfiles, 0 skipped/malformed, run §40947637508.

Status: create_discussion detection: 93/94 categories resolved (98.9%) — within tolerance, 1 workflow unresolved (see Quality notes). All other parsers fully resolved (0 unknown engines, 0 unknown agent-job permissions, 0 missing safe-output configs, 0 MCP-manifest fallbacks).

Key metrics

Metric	Value
Total lockfile bytes	62,829,151 (avg 180,026 B · min 100,543 B · max 347,824 B)
Avg jobs / steps / script-steps per workflow	9.08 / 157.33 / 108.97
Max jobs / steps / script-steps	25 / 343 / 196
workflow_dispatch present	339 / 349 (97.1%)
schedule present	253 / 349 (72.5%)
Engines resolved	14 distinct, 0 unknown

File size distribution

Sizes cluster tightly: avg 180 KB, range 98.2 KB–339.7 KB. No outlier bloat detected.

Trigger analysis

Top combinations:

Combination	Count	%
schedule + workflow_dispatch	216	61.9%
workflow_dispatch only	73	20.9%
pull_request + schedule + workflow_dispatch	33	9.5%
pull_request + workflow_dispatch	9	2.6%
pull_request only	3	0.9%

Cron: the dominant schedule is 0 0 */2 * * (every 2 days, midnight) at 61 occurrences (24.1% of scheduled workflows); the remaining ~190 scheduled workflows use distinct, largely de-synchronized cron expressions (likely to avoid runner thundering-herd).

All trigger type counts

workflow_dispatch 339 · schedule 253 · pull_request 47 · workflow_call 5 · issues 5 · issue_comment 3 · push 2 · deployment_status 1 · workflow_run 1 · discussion 1 · discussion_comment 1 · repository_dispatch 1 · pull_request_review_comment 1

Safe outputs analysis

Scaffolding types (noop, report_incomplete, report_missing_data, report_missing_tool, create_report_incomplete_issue) appear in ~98% of workflows — effectively universal boilerplate. Content-producing types:

Type	Count	%
create_issue	174	49.9%
create_discussion	93	26.6%
create_pull_request	77	22.1%
add_comment	74	21.2%
push_repo_memory	32	9.2%
add_labels	32	9.2%
upload_asset	26	7.4%
mentions	24	6.9%

Beyond these, a long tail of 40+ single/low-use integrations exists (Jira, Linear, Slack, code-scanning alerts, project updates, etc.) — see methodology note.

Discussion categories (93 resolved of 94 create_discussion configs): audits 80 (86.0%), announcements 5, artifacts 2, dev 2, research 2, general 1, daily-news 1.

Structural characteristics

• Avg 9.08 jobs/workflow (max 25, min 6)
• Avg 157.33 steps/workflow (max 343, total 54,907)
• Avg 108.97 script-execution steps/workflow (69.3% of all steps are script steps) — these are compiler-generated automation pipelines, not thin hand-written wrappers.

Permission patterns (agent job — not the always-empty top-level permissions: {})

The agent job itself is read/none-only almost everywhere — writes are delegated elsewhere (safe-outputs pattern):

Scope	read	write	none
contents	349 (100%)	0	0
issues	261 (74.8%)	0	88
pull-requests	255 (73.1%)	0	94
actions	141 (40.4%)	0	208
discussions	52 (14.9%)	0	297
security-events	15 (4.3%)	0	334
id-token	0	4 (1.1%)	345
checks / statuses / pages	0	0	349

Union across all jobs per workflow (any job granting write): id-token 349/349 (100%), issues 346 (99.1%), copilot-requests 172 (49.3%), contents 234 (67.0%), pull-requests 162 (46.4%), discussions 98 (28.1%), actions 143 (41.0%).

Engine distribution

Engine	Count	%
copilot	145	41.5%
codex	77	22.1%
claude	63	18.1%
pi	38	10.9%
aider / goose	4 each	1.1% each
agy / opencode	3 each	0.9% each
crush / cursor / deepseek-harness / gemini / kiro / pydantic-ai	2 each	0.6% each

49+ distinct agent_model strings observed (top: copilot/auto 15, copilot/gpt-5 12), including unresolved dynamic expressions like ${{ needs.activation.outputs.model_size }} and copilot/${{ inputs.model }} — these are parameterized at dispatch time and can't be statically resolved from the lockfile.

Tool & MCP patterns

safeoutputs 349 (100%, scaffold), github 208 (59.6%), agenticworkflows 44 (12.6%), work-queue 37 (10.6%), mcpscripts 33 (9.5%), serena 24 (6.9%), plus low-frequency servers (tavily, sentry, grafana, ast-grep, datadog, deepwiki, microsoftdocs, kreuzberg, graft, agentdb — ≤5 each). All manifests parsed via gh-aw-manifest; 0 fallback-scraped.

Timeout distribution (across all jobs)

5 min: 702 · 10 min: 387 · 60 min: 338 · 15 min: 264 · 45 min: 83 · remainder (2–300 min): 17. Two canonical shapes: short safe-output/processing jobs (~5–15 min) and long agent jobs (~60 min).

Interesting findings

1. 97.1% of workflows support workflow_dispatch and 72.5% are scheduled, with schedule+workflow_dispatch alone covering 61.9% of the fleet — the dominant design is "automated + manually triggerable."
2. The agent job is consistently read/none-scoped (100% read-only on contents, never write except 1.1% on id-token), while a union of jobs grants id-token write in 100% and issues write in 99.1% of workflows — strong, consistent adherence to the safe-outputs write-isolation pattern.
3. Engine/model diversity is high: 14 engines and 49+ model identifiers across 349 workflows, including unresolvable dynamic model expressions — worth periodic review since compiled lockfiles won't reflect upstream model changes until recompiled.
4. Safe-output usage is bimodal: near-universal scaffolding (~98%) plus a small set of common content types (issue/discussion/PR creation, comments) alongside 40+ long-tail, single-use integrations (Jira, Linear, Slack, code scanning).
5. Day-over-day (2026-10-28 → 2026-10-29) the fleet is essentially static: +10,195 bytes total (+0.016%), +2 steps, and exactly one workflow's cron changed from daily to Tuesday-only (* * * → * * 2). No structural or permission drift.

Historical trends (vs. 2026-10-28)

Metric	2026-10-28	2026-10-29	Δ
Lockfiles	349	349	0
Total bytes	62,818,956	62,829,151	+10,195 (+0.016%)
Total steps	54,905	54,907	+2
Script steps	38,029	38,029	0
Avg jobs	9.0745	9.0774	+0.003

No changes in trigger mix, safe-output types, discussion categories, permission distributions, engine distribution, or MCP server usage between the two snapshots.

Quality notes

• 0 skipped/malformed lockfiles; yaml_available: true.
• safe_outputs_config_missing: 0 — config found in all 349 lockfiles (no regex fallback needed for safe outputs).
• engine_unknown: 0, agent_job_permissions_unknown: 0, mcp_fallback_count: 0.
• Discussion-category detection: 93/94 (98.9%) resolved — within the 90% tolerance threshold, but the analyzer's own self-check still flags this run partial_or_failed since it is not 100%. One create_discussion-configured workflow has a category that neither the structured GH_AW_SAFE_OUTPUTS_CONFIG parse nor the regex fallback could resolve; worth a manual spot-check but not indicative of a broken extraction pipeline (94 ≠ 0 created, 93 ≠ 0 detected).

Recommendations

1. Manually identify and fix the single workflow with an unresolved create_discussion category (93/94 resolved) so future runs hit 100% detection.
2. Audit the ~3% of workflows lacking workflow_dispatch (workflow_call/push-only triggers) for consistency with the dominant dispatch-plus-schedule pattern.
3. Periodically resolve dynamic agent_model expressions (e.g. ${{ inputs.model }}) against actual dispatch inputs to confirm pinned models are still supported.
4. Spot-check jobs with outlier timeouts (90–300 min) for runaway-job risk, since the fleet norm is 5–15 min (fast jobs) or 60 min (agent jobs).

Methodology: single-script compact JSON analysis (lockfile_stats_v4.py, cached in cache-memory/scripts/), parsing gh-aw-metadata/gh-aw-manifest header comments and GH_AW_SAFE_OUTPUTS_CONFIG env JSON via yaml.safe_load + json.loads; no raw lockfile cat/grep performed outside the analyzer.

References:

• §40947637508

Generated by 📊 Lockfile Statistics Analysis Agent · claude · agent · ~51 AIC · ⌖ ~1 AIC · ⊞ 4.3K · ◷

• expires on Oct 30, 2026, 12:24 PM UTC-08:00