[lockfile-stats] Lockfile Statistics Report — 2026-10-02 (302 workflows)

[github-actions[bot]]

Lockfile Statistics Report — 2026-10-02

302 compiled lockfiles analyzed (0 skipped/malformed) · 45.4 MB total · avg 153.8 KB/file (min 90.9 KB, max 247.1 KB)

File size distribution

Metric	Value
Lockfiles	302
Total size	47,558,962 bytes (45.37 MB)
Average size	157,480 bytes (153.8 KB)
Min size	93,063 bytes
Max size	252,998 bytes

Trigger analysis

Trigger	Count	% of lockfiles
workflow_dispatch	294	97.4%
schedule	246	81.5%
pull_request	43	14.2%
issues	5	1.7%
issue_comment	3	1.0%
workflow_call	3	1.0%
discussion / discussion_comment / push / workflow_run / deployment_status / pull_request_review_comment	1 each	0.3%

Top trigger combinations: schedule+workflow_dispatch (213), workflow_dispatch only (37), pull_request+schedule+workflow_dispatch (29), pull_request+workflow_dispatch (9).

Most common cron cadence: 0 0 */2 * * (every 2 days) — 45 workflows. Long tail of unique daily/weekday crons beyond that.

Safe outputs analysis

Safe output type	Count
missing_data / missing_tool / noop / report_incomplete / create_report_incomplete_issue	296 (98.0%)
create_issue	148
create_discussion	92
add_comment	76
create_pull_request	65
push_repo_memory	35
add_labels	32
upload_asset	26

Discussion category breakdown (92 workflows producing discussions): audits 79, announcements 5, artifacts 2, dev 2, research 2, general 1, daily-news 1.

Detection self-check: create_discussion_workflows=92, discussion_category_detected=92 (100%), unresolved=0, regex-fallback used=0, safe_outputs_config_missing=0 — full JSON-based extraction succeeded for every discussion-producing workflow.

Structural characteristics

Metric	Avg	Max
Jobs/workflow	7.35	14
Steps/workflow	146.2	212
Script (run:) steps/workflow	101.0	142

Timeout distribution (job-level, minutes)

Timeout	Job count
10	356
45	302
60	295
90	3
5	2
120	2
180	1
15	1

Permission patterns (agent job only; top-level permissions: {} carries no signal)

Scope	read	write	none
contents	302	0	0
issues	260	0	42
pull-requests	255	0	47
actions	114	0	188
discussions	52	0	250
security-events	14	0	288
id-token	0	2	300

permissions_unknown=0 — every lockfile's agent job permissions resolved cleanly. The agent job is read-only almost everywhere; writes are delegated to a separate safe-outputs applier job.

Union-of-all-jobs permissions (effective write capability per workflow)

Scope	write	read	none
contents	209	93	0
issues	302	0	0
pull-requests	146	116	40
actions	110	192	0
discussions	96	10	196
checks	14	0	288

union_any_write_count = 302/302 (100%) — every workflow has at least one job (the safe-outputs applier) capable of a write, confirming the read-only-agent / write-only-applier security pattern holds repo-wide.

Engine distribution

Engine (agent_id)	Count	Share
copilot	127	42.1%
codex	74	24.5%
claude	56	18.5%
pi	31	10.3%
aider / goose	3 each	1.0%
opencode	2	0.7%
crush / cursor / deepseek-harness / gemini / kiro / pydantic-ai	1 each	0.3%

engine_unknown=0 — every lockfile's gh-aw-metadata resolved an agent_id.

Tool & MCP patterns

MCP server	Workflows
safeoutputs	302 (100%)
github	179 (59.3%)
agenticworkflows	44
serena	25
mcpscripts	12
tavily	5
sentry	4

mcp_fallback_used_count=0 — all server/tool usage came from the gh-aw-manifest JSON, no legacy scraping needed.

Interesting findings

1. Universal write isolation: agent jobs never hold write on issues/pull-requests/discussions (all read/none), yet 100% of workflows have some job with write access — the safe-outputs applier-job pattern is applied without exception across all 302 lockfiles.
2. Standard safe-output scaffolding is near-universal: missing_data/missing_tool/noop/report_incomplete appear in 296/302 (98.0%) lockfiles; 6 lockfiles lack the standard contract, likely older or specialized workflows worth auditing.
3. Discussion-category extraction is fully reliable: 92/92 create_discussion workflows resolved a category via direct JSON parsing, with zero fallback-regex or unresolved cases — audits accounts for 86% (79/92) of discussion output.
4. Scheduled automation dominates: 81.5% of workflows run on a cron, and 213 of those 246 (86.6%) also carry workflow_dispatch for manual re-runs — near-total adoption of the schedule+dispatch pairing.
5. Engine concentration: copilot and codex together power 66.6% of workflows (201/302), with claude at 18.5%; the remaining 9 engines are long-tail, each under 1.3%.

Historical trends (vs. 2026-10-01)

Metric	2026-10-01	2026-10-02	Δ
Lockfiles	301	302	+1
Total bytes	47,386,965	47,558,962	+171,997 (+0.36%)
Avg size	157,431.8	157,480.0	+48.2
workflow_dispatch count	293	294	+1
create_discussion workflows	92	92	0
copilot engine count	126	127	+1

Growth is incremental — one new lockfile added, attributable to the copilot engine, with no shift in discussion-category or safe-output adoption.

Recommendations

• Audit the 6 lockfiles missing the standard missing_data/missing_tool/noop/report_incomplete safe-output scaffolding for consistency with the rest of the fleet.
• Consider consolidating the long cron tail (many unique one-off schedules) where a shared cadence (e.g. the dominant 0 0 */2 * *) would reduce scheduling sprawl.
• No permission or engine-detection issues found — engine_unknown, permissions_unknown, and safe_outputs_config_missing are all 0; the extraction pipeline is healthy.

Methodology: single-script compact JSON analysis (lockfile_stats_v4.py, cached in cache-memory), parsing gh-aw-metadata/gh-aw-manifest comments and GH_AW_SAFE_OUTPUTS_CONFIG env JSON across all .github/workflows/*.lock.yml files in one pass.

Generated by 📊 Lockfile Statistics Analysis Agent · claude · agent · 86.1 AIC · ⌖ 7.28 AIC · ⊞ 6.5K · ◷

• expires on Oct 3, 2026, 12:30 PM UTC-08:00

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-10-03T20:30:02.722Z.

Closed by Workflow