[lockfile-stats] Lockfile Statistics — 2026-09-13

[github-actions[bot]]

Executive summary: 299 compiled .lock.yml workflows, 46,367,016 bytes total (~44.2 MB), avg 155.1 KB, min 91.6 KB, max 248.1 KB. 0 malformed/skipped files.

File size distribution

Metric	Value
Count	299
Total	46,367,016 bytes (~44.2 MB)
Avg	155,073.6 bytes
Min	91,637 bytes
Max	248,054 bytes

Trigger analysis

Trigger	Count	%
workflow_dispatch	291	97%
schedule	242	81%
pull_request	43	14%
issues	5	2%
issue_comment	3	1%
workflow_call	3	1%
other (deployment_status, workflow_run, discussion, discussion_comment, push, pull_request_review_comment)	1 each	<1%

Top trigger combinations: schedule+workflow_dispatch (209), workflow_dispatch only (38), pull_request+schedule+workflow_dispatch (29), pull_request+workflow_dispatch (9).

Cron frequencies: 0 0 */2 * * (every 2 days) is the single largest cluster at 42 workflows; the remaining ~30 distinct cron strings are mostly unique per-workflow minute/hour offsets — a jitter pattern to avoid runner stampedes.

Safe outputs analysis

Near-universal scaffolding: noop, missing_tool, missing_data, report_incomplete each appear in 293/299 workflows (98%). Beyond that: create_issue 146 (49%), create_discussion 92 (31%), add_comment 77 (26%), create_pull_request 64 (21%), push_repo_memory 36, add_labels 32, upload_asset 26, mentions 23, then a long tail down to single-use types (e.g. jira_create_issue, linear_create_issue, update_project).

Discussion categories (92 create_discussion workflows, all 92 resolved — 0 unresolved):

Category	Count
audits	79
announcements	5
artifacts	2
dev	2
research	2
general	1
daily-news	1

Structural characteristics

Metric	Avg	Max
Jobs/workflow	7.35	14
Steps/workflow	145.74	208
Script steps/workflow	101.75	140

Permission patterns

Agent job (primary per-workflow scope, mirrors frontmatter permissions:):

Scope	read	write	none
contents	299	–	–
issues	260	–	39
pull-requests	255	–	44
actions	114	–	185
discussions	52	–	247
security-events	14	–	285
id-token	–	2	297
checks/deployments/packages	1 each	–	298 each
pages/repository-projects/statuses/attestations	–	–	299

Union across all jobs (a scope counts write if any job grants it): all 299 workflows grant at least one write scope. Notably issues is write in all 299 (100%) at the union level despite the agent job itself often being read/none — some other job (safe-outputs handler) carries that write grant. contents write 206 / read 93; pull-requests write 146 / read 116 / none 37; discussions write 96 / read 10 / none 193.

permissions_unknown: 0 (fully resolved for every lockfile).

Engine distribution

Engine	Count	%
copilot	123	41%
codex	74	25%
claude	56	19%
pi	31	10%
aider / opencode / goose	3 each	1%
crush / cursor / deepseek-harness / gemini / kiro / pydantic-ai	1 each	<1%

engine_unknown: 0 (resolved via gh-aw-metadata agent_id for every lockfile).

Tool & MCP patterns

MCP servers by workflow count: safeoutputs 299 (100%, always present), github 175 (59%), agenticworkflows 44, serena 25, mcpscripts 12, tavily 5, sentry 3, remainder (ast-grep, datadog, deepwiki, microsoftdocs, grafana, kreuzberg, mempalace, graft, agentdb, ruflo) 1–2 each. No fallback (comment-scraping) parsing was needed — 100% resolved via the gh-aw-manifest JSON.

Timeout distribution (minutes, across job step declarations): 10min ×318, 45min ×299, 60min ×292, then rare 90/5/120/180/15.

Interesting findings

1. Every workflow's union permissions include issues: write (299/299), even though many agent jobs themselves only hold issues: read or none — the write grant is carried by a downstream job (safe-outputs handler), not the agent step itself.
2. copilot is the dominant engine (41%), ahead of codex (25%) and claude (19%) — notable for a fleet this large maintained inside the gh-aw project itself.
3. audits is the overwhelming default discussion category (79/92, 86%) for create_discussion workflows — this very report follows that convention.
4. workflow_dispatch is near-universal (291/299, 97%), indicating manual-trigger support is treated as a standard convention rather than an opt-in.
5. Cron scheduling is bimodal: one large synchronized cluster at "every 2 days" (42 workflows) versus a long tail of unique per-minute offsets elsewhere — a deliberate jitter pattern to avoid stampeding runners at any single time.

Historical trends (vs. 2026-09-12)

Metric	2026-09-12	2026-09-13	Δ
Lockfile count	299	299	0
Total bytes	46,159,253	46,367,016	+207,763 (+0.45%)
Avg size	154,378.8	155,073.6	+694.8
Max size	246,835	248,054	+7,219
Steps/workflow (avg)	144.64	145.74	+1.10
Script steps/workflow (avg)	101.19	101.75	+0.56

Engine, permission, MCP, safe-output-type, and discussion-category distributions were unchanged day-over-day except a minor model-string shift (copilot/gpt-5.3-codex 34→33). Overall: a quiet day of incremental workflow growth with no structural or engine-mix shifts.

Recommendations

• 100% of workflows carry issues: write at the union level, but only 146/299 (49%) actually use create_issue/update_issue/etc. Consider auditing whether the safe-outputs job's issues: write grant can be scoped down for workflows that never emit issue-related safe outputs.
• Spot-check a few of the 42 workflows sharing the 0 0 */2 * * cron to confirm minute/hour offsets are still deliberately staggered, since they share the same day-cadence.
• audits covers 86% of discussion-producing workflows; confirm this default isn't masking missing category configuration for workflows that intend a different category.
• Track the copilot/codex/claude engine mix over time — worth confirming whether copilot's 41% share reflects deliberate default guidance or organic workflow-author choice.

Methodology: single-script compact JSON analysis.

References:

• §34780456254

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by 📊 Lockfile Statistics Analysis Agent · claude · agent · 94.3 AIC · ⌖ 8.03 AIC · ⊞ 8.5K · ◷

• expires on Sep 14, 2026, 12:28 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Lockfile Statistics Analysis Agent.

A newer discussion is available at Discussion #60922.