[lockfile-stats] Lockfile Statistics Analysis — 2026-08-06 (276 workflows)

[github-actions[bot]]

Executive summary

Analyzed 276 compiled .github/workflows/*.lock.yml files on 2026-08-06. All 276 parsed cleanly (0 skipped). Total size 37,775,563 bytes (~36.0 MiB), average 136,868 bytes (~133.7 KiB) per lockfile.

Metric	Value
Lockfiles analyzed	276 (0 skipped)
Total size	36.0 MiB
Avg / Min / Max size	133.7 KB / 79.9 KB (notion-issue-summary) / 210.5 KB (smoke-copilot-aoai-entra)
Total jobs / steps / scripts	2,039 / 36,891 / 16,199
Distinct engines	11

File size distribution

Stat	File	Bytes
Min	notion-issue-summary.lock.yml	81,764
Max	smoke-copilot-aoai-entra.lock.yml	215,508
Avg	—	136,868

Trigger analysis

Trigger	Count	% of 276
workflow_dispatch	269	97.5%
schedule	187	67.8%
pull_request	37	13.4%
issues	4	1.4%
issue_comment	2	0.7%
workflow_call	2	0.7%
deployment_status / workflow_run / discussion / discussion_comment / push	1 each	0.4%

Top trigger combinations: schedule+workflow_dispatch (184, 67%), workflow_dispatch alone (48, 17%), pull_request+workflow_dispatch (32, 12%).

Cron clustering: 11 distinct cron expressions are each reused by exactly 2 workflows (e.g. 49 5 * * *, 9 3 * * *, 52 23 * * *), meaning 22 of 187 scheduled workflows (~12%) fire at the exact same minute as another workflow.

Safe outputs analysis

Type	Count
other (boilerplate: noop/missing_data/missing_tool/report_incomplete/create_report_incomplete_issue)	1,534
create-issue	127
create-discussion	88
add-comment	66
create-pull-request	55
create-pull-request-review-comment	12
update-issue	9

Discussion categories (of 88 create-discussion configs): audits 78 (89%), artifacts 2, dev 2, announcements 2, research 2, general 1, daily-news 1.

Structural characteristics

	Total	Avg/file	Min	Max
Jobs	2,039	7.39	4 (codex-github-remote-mcp-test)	14 (release)
Steps	36,891	133.66	80 (codex-github-remote-mcp-test)	191 (daily-news)
Scripts (run steps)	16,199	58.69	36 (codex-github-remote-mcp-test)	82 (daily-news)

Permission patterns

• Top-level permissions: is {} (empty) in all 276/276 lockfiles (100%) — every actual grant is scoped at the job level, not the workflow level.
• Job-level scope grants: 2,421 read vs 1,877 write (no bare none values observed).

Top scopes: contents:read 1,214, actions:read 659, issues:write 622, contents:write 388, pull-requests:write 308, pull-requests:read 244, issues:read 234, copilot-requests:write 222, discussions:write 189, actions:write 106.

Timeouts: 45 min (276 instances — the standard agent-job timeout, one per file), 10 min (29, helper jobs), 5 min (2).

Tool & MCP patterns

Engine distribution (11 engines): copilot 168 (60.9%), claude 59 (21.4%), pi 21 (7.6%), codex 15 (5.4%), crush 3, opencode 3, goose 3, aider 1, cursor 1, gemini 1, kiro 1.

Top engine models: copilot/gpt-5.4 21, copilot/claude-sonnet-4.5 9, gpt-5.4 7, claude-haiku-4.5 5, claude-sonnet-4.6 5, dynamic ${{ needs.activation.outputs.model_size }} 4.

MCP servers in use (dedup per workflow): safeoutputs 276 (100%, universal scaffold), github 110 (40%), agenticworkflows 41 (15%), serena 24 (9%), mcpscripts 12, tavily 5, sentry 3, plus single-digit long tail (ast-grep, arxiv, datadog, deepwiki, microsoftdocs, grafana, mempalace, graft, agentdb, open-ontologies, context7, fabric-rti, memory, ruflo).

Caveat: guard-policies (3) appearing in the server list is a parsing artifact of the indentation-based extraction (it's a config block, not an actual MCP server) — noted for transparency, not corrected in aggregate counts.

Full raw JSON summary

Available at /tmp/gh-aw/agent/lockfile-stats-summary.json (3.2 KB) for this run.

Interesting findings

1. 97.5% workflow_dispatch adoption — manual/on-demand triggering is a near-universal convention across the fleet, not an occasional add-on.
2. Perfect least-privilege discipline at the workflow level: 100% of lockfiles declare empty top-level permissions, pushing every grant down to job scope — zero exceptions found.
3. Cron collisions: 11 cron strings are shared by exactly 2 workflows each (22 workflows total, ~12% of scheduled workflows), a mild contention/rate-limit risk worth staggering.
4. audits dominates discussion output (89% of create-discussion configs) — this very report follows that same convention.
5. Engine concentration: despite 11 distinct engines being supported, copilot + claude alone account for 82% (227/276) of all workflows.

Historical trends

No prior summary found in /tmp/gh-aw/cache-memory/history/ — this run seeds the baseline at 2026-08-06.json for future comparisons.

Recommendations

• Stagger the 11 duplicate cron schedules to reduce simultaneous-run contention and API rate-limit spikes.
• Audit whether underused discussion categories (dev, research, announcements, general) are intentional or simply not yet adopted by more workflows.
• Preserve the current 100% job-scoped permission pattern as new workflows are added — no top-level permission grants were found to regress.
• Spot-check the 4 workflows using dynamic model-size selection (${{ needs.activation.outputs.model_size }}) to confirm consistent resolution across activation paths.

Methodology note

Single-script compact JSON analysis: one Python analyzer (cached at /tmp/gh-aw/cache-memory/scripts/lockfile_stats_v1.py) parsed all lockfiles with yaml.safe_load plus targeted regex extraction (safe-outputs config JSON, MCP server blocks, engine metadata comment) in one pass, producing a compact summary JSON reasoned over in a second turn. 0 lockfiles were skipped as malformed.

Generated by 📊 Lockfile Statistics Analysis Agent · agent · 64.3 AIC · ⌖ 30.9 AIC · ⊞ 5.9K · ◷

• expires on Aug 7, 2026, 2:27 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Lockfile Statistics Analysis Agent.

A newer discussion is available at Discussion #51189.