[lockfile-stats] Lockfile Statistics Report — 2026-10-15

[github-actions[bot]]

Executive summary

Analyzed 344 compiled lockfiles (.github/workflows/*.lock.yml) on 2026-10-15, totaling 53.5 MB (56,086,698 bytes). 0 files skipped as malformed.

Metric	Value
Lockfiles	344
Total size	56,086,698 bytes (~53.5 MB)
Avg / min / max size	163,043 / 91,286 / 291,249 bytes
Engines (distinct)	14, 0 unknown
Workflows with workflow_dispatch	335 (97%)
Workflows producing create_discussion	93

File size distribution

• Average lockfile: 163 KB; smallest 89.2 KB, largest 284.4 KB — a ~3.2x spread, consistent with varying tool/step counts rather than outliers.
• Total compiled weight across the repo: ~53.5 MB.

Trigger analysis

Trigger	Workflows	Share
workflow_dispatch	335	97%
schedule	251	73%
pull_request	47	14%
workflow_call	5	1%
issues	5	1%
issue_comment	3	<1%
push	2	<1%
others (deployment_status, workflow_run, discussion, discussion_comment, pull_request_review_comment)	1 each	<1%

Top trigger combinations: schedule+workflow_dispatch (214, 62%), workflow_dispatch only (71, 21%), pull_request+schedule+workflow_dispatch (33, 10%), pull_request+workflow_dispatch (9), pull_request only (3).

Most common cron: 0 0 */2 * * (every 2 days at midnight UTC) — used by 60 workflows, 24% of all 251 scheduled workflows. No other cron pattern is used by more than 3 workflows.

Safe outputs analysis

Baseline control-flow outputs (noop, missing_data, missing_tool, report_incomplete, create_report_incomplete_issue) are each wired into 337 of 344 workflows (98%), confirming near-universal adoption of the standard safe-outputs scaffolding.

Top substantive safe-output types:

Type	Workflows
create_issue	183 (53%)
create_discussion	92† (27%)
add_comment	74 (21%)
create_pull_request	65 (19%)
push_repo_memory	33 (10%)
add_labels	32 (9%)
upload_asset	26 (8%)

† One additional workflow has create_discussion configured but its category couldn't be resolved (see below), for 93 total create_discussion workflows.

Discussion categories (92 of 93 resolved — 99% detection rate):

Category	Count
audits	79 (86%)
announcements	5
artifacts	2
dev	2
research	2
general	1
daily-news	1

pr-sous-chef.lock.yml is the one workflow where create_discussion is present but no category (explicit or default) could be resolved from config or fallback parsing — a 1.1% gap, within tolerance but worth a manual check.

safe_outputs_config_missing: 1 lockfile had no parsable GH_AW_SAFE_OUTPUTS_CONFIG/HANDLER_CONFIG env value at all (same workflow as above).

Full safe-output type counts (click to expand)

create_issue 183 · create_discussion 92 · add_comment 74 · create_pull_request 65 · push_repo_memory 33 · add_labels 32 · upload_asset 26 · mentions 24 · create_pull_request_review_comment 16 · submit_pull_request_review 16 · upload_artifact 15 · create_check_run 14 · update_issue 10 · push_to_pull_request_branch 10 · max_bot_mentions 9 · dispatch_workflow 9 · ledger_append 7 · close_issue 7 · remove_labels 7 · ledger_request_compaction 6 · comment_memory 6 · assign_to_agent 5 · link_sub_issue 4 · update_pull_request 4 · close_pull_request 4 · send-slack-message 4 · create_code_scanning_alert 3 · close_discussion 3 · reply_to_pull_request_review_comment 3 · set_issue_type 3 · and 18 more types at 1-2 workflows each (hide_comment, assign_to_user, create_agent_session, upload_code_coverage, jira_*, linear_create_issue, update_project, etc.)

Structural characteristics

Metric	Total	Avg/workflow	Max
Jobs	2,439	7.1	23
Steps	50,326	146.3	326
Script steps (run: / with.script)	22,093	64.2	97

Permission patterns (agent job, not the always-empty top-level block)

Agent-job scopes are overwhelmingly read-only; only copilot-requests and id-token ever appear as write at the agent-job level:

Scope	read	write
contents	344 (100%)	0
issues	261 (76%)	0
pull-requests	255 (74%)	0
actions	140 (41%)	0
discussions	53 (15%)	0
copilot-requests	0	166 (48%)
security-events	14 (4%)	0
id-token	0	4 (1%)

permissions_unknown: 0 — every lockfile's agent-job permissions resolved cleanly.

Union across all jobs (any job granting write) tells a different story — write access is pushed into dedicated publisher jobs: issues write appears in 342/344 workflows (99%), contents in 229 (67%), copilot-requests in 166 (48%), pull-requests in 151 (44%), discussions in 96 (28%). 342 of 344 workflows (99.4%) grant write somewhere in their job graph.

Engine distribution

(from gh-aw-metadata agent_id, 0 unresolved)

Engine	Workflows	Share
copilot	141	41%
codex	77	22%
claude	62	18%
pi	38	11%
aider	4	1%
goose	4	1%
agy	3	<1%
opencode	3	<1%
crush, cursor, deepseek-harness, gemini, kiro, pydantic-ai	2 each	<1%

Tool & MCP patterns

MCP server usage (from gh-aw-manifest; 7 lockfiles fell back to legacy tool-comment scraping):

Server	Workflows
safeoutputs	321 (93%)
github	194 (56%)
work-queue	33 (10%)
agenticworkflows	27 (8%)
mcpscripts	26 (8%)
serena	16 (5%)
agy-native, tavily	3 each
sentry	2
kreuzberg, graft, ast-grep, grafana, deepwiki, microsoftdocs	1 each

Interesting findings

1. Clean separation of concerns: the agent job is almost always read-only (only copilot-requests/id-token ever write there), while 99.4% of workflows grant write somewhere else in the job graph — writes are consistently delegated to dedicated safe-output publisher jobs, not the reasoning agent.
2. Engine diversity: Copilot (41%) leads but doesn't dominate — Codex (22%) and Claude (18%) are both well represented, plus a long tail of 10 other engines (agy, opencode, crush, cursor, deepseek-harness, gemini, kiro, pydantic-ai, aider, goose) each used by ≤4 workflows.
3. Discussion category concentration: 86% of resolved create_discussion workflows (79/92) target the audits category — this very report included — versus a long tail of 6 other categories.
4. Schedule clustering risk: 60 workflows (24% of all scheduled workflows) share the exact same cron 0 0 */2 * *, a potential simultaneous-runner-start spike every other midnight UTC.
5. One unresolved discussion category: pr-sous-chef.lock.yml has create_discussion configured but no detectable category via config or fallback regex — the sole gap in an otherwise 99%-detected dataset.

Historical trends (vs. 2026-10-14)

Lockfile count, trigger counts, safe-output type counts, discussion categories, engine distribution, and MCP usage are all unchanged day-over-day — only compiled sizes and job/step counts grew slightly, consistent with routine recompilation rather than substantive workflow changes:

Metric	2026-10-14	2026-10-15	Δ
Lockfiles	344	344	0
Total bytes	55,904,001	56,086,698	+182,697 (+0.33%)
Avg bytes	162,512	163,043	+531
Total jobs	2,436	2,439	+3
Total steps	50,137	50,326	+189
Script steps	21,937	22,093	+156
contents write (union)	228	229	+1

Recommendations

• Investigate pr-sous-chef.lock.yml's create_discussion configuration to close the one unresolved discussion-category case.
• Review whether the 60 workflows sharing cron 0 0 */2 * * need staggering to avoid simultaneous runner starts.
• Periodically audit the engine long-tail (7 engines at ≤3 workflows each) to confirm they're intentional experiments rather than stale configuration.

Methodology note

single-script compact JSON analysis

References:

• §38801172459

Generated by 📊 Lockfile Statistics Analysis Agent · claude · agent · 84.7 AIC · ⊞ 6.5K · ◷

• expires on Oct 16, 2026, 12:27 PM UTC-08:00