[lockfile-stats] Lockfile Statistics — 2026-09-01 (298 workflows)

[github-actions[bot]]

Lockfile Statistics — 2026-09-01

Analysis of all .github/workflows/*.lock.yml compiled agentic workflows in github/gh-aw.

Overview

Metric	Value	Δ vs 2026-08-31
Lockfiles analyzed	298	+1
Skipped (malformed)	0	—
Total size	45,439,756 bytes (43.3 MiB)	+168,320 bytes
Avg / min / max size	152,482 / 91,823 / 244,390 bytes	avg +53, max +2,566

File size distribution

• Average lockfile: ~149 KiB; smallest 90 KiB, largest 239 KiB.
• Sizes are tightly clustered — max/min ratio is only ~2.7x across 298 files, consistent with a shared compiler template dominating file size rather than per-workflow logic.

Trigger analysis

Trigger	Count	Share
workflow_dispatch	290	97%
schedule	241	81%
pull_request	43	14%
issues	5	2%
issue_comment	3	1%
workflow_call	3	1%
discussion / discussion_comment / push / deployment_status / workflow_run / pull_request_review_comment	1 each	<1%

Top trigger combinations: schedule+workflow_dispatch (208, +1), bare workflow_dispatch (38), pull_request+schedule+workflow_dispatch (29).

Cron cadence: 0 0 */2 * * (every 2 days) dominates at 42 workflows; the remainder is a long tail of unique daily/weekday schedules — no other cron string appears more than 3 times.

Safe outputs analysis

Nearly universal utility outputs: missing_data, missing_tool, noop, report_incomplete each appear in 292 workflows (+1). Beyond those:

Safe output type	Count	Δ
create_issue	145	—
create_discussion	92	—
add_comment	77	—
create_pull_request	64	+1
push_repo_memory	34	—
add_labels	32	—

Discussion categories (92 workflows configure create_discussion, all 92 resolved to a category — no detection gap):

Category	Count
audits	79
announcements	5
artifacts	2
dev	2
research	2
general	1
daily-news	1

audits is the overwhelming default category (86% of discussion-producing workflows), consistent with this workflow's own output target.

Structural characteristics

Metric	Avg	Max	Δ (max)
Jobs per workflow	7.33	14	—
Steps per workflow	144.3	205	+3
Script steps per workflow	99.4	136	+3

Timeout-minutes distribution across jobs: 10min (317 jobs), 45min (298), 60min (291) are the three dominant ceilings; a handful of jobs use 90/120/180/5/15 minutes.

Permission patterns (agent job)

Scope	read	write	none
contents	298	0	0
issues	260	0	38
pull-requests	255	0	43
actions	113	0	185
discussions	52	0	246
security-events	14	0	284
id-token	0	2	296

The agent job itself never carries direct write permissions on GitHub-native scopes — writes are delegated to the safe-outputs mechanism. Union across all jobs (including the safe-outputs writer job) tells a different story: all 298 workflows grant issues: write somewhere, and 205 grant contents: write — the actual privileged writing happens in a separate, narrowly-scoped job.

Engine distribution

Engine	Count	Δ
copilot	120	—
codex	76	+1
claude	56	—
pi	29	—
crush / aider / opencode / goose	3 each	—
cursor / deepseek-harness / gemini / kiro / pydantic-ai	1 each	—

engine_unknown = 0 — every lockfile resolved an engine ID. Top agent models: openai/gpt-5.4 (49), copilot/mai-code-1-flash-picker (44), copilot/claude-sonnet-4.5 (12). A new model variant, copilot/gpt-5.6-sol, appears for the first time today.

Tool & MCP patterns

safeoutputs (298) and github (120) are the dominant MCP servers; agenticworkflows (44) and serena (25) follow. One workflow that previously used the playwright MCP server no longer does in today's snapshot. Most-used individual GitHub tools cluster around release/commit/tag introspection (get_commit, get_file_contents, get_latest_release, etc., each at 118).

Interesting findings

1. Zero unknowns across the board — every lockfile resolved an engine ID, a permissions block, and a safe-outputs config; the extraction pipeline has no blind spots in this run.
2. Permission delegation is structural, not incidental — the agent job is read-only on every GitHub-native scope in 100% of workflows, while a separate job carries all write grants (issues: write in all 298). This is a consistent architectural pattern across the whole fleet, not a handful of outliers.
3. audits category dominance — 86% of discussion-producing workflows post to the audits category, suggesting most discussion-based workflows in this repo are periodic-scan/report agents like this one.
4. Growth is incremental, not bursty — day-over-day the fleet added exactly 1 lockfile, 1 create_pull_request consumer, and 1 codex-engine workflow; size and structural metrics moved by low single-digit percentages.
5. Cron scheduling is mostly bespoke — aside from the 0 0 */2 * * cluster (42 workflows), the remaining ~200 scheduled workflows use largely unique cron strings, implying schedules are hand-picked per workflow rather than templated.

Historical trend (2026-08-31 → 2026-09-01)

Metric	2026-08-31	2026-09-01	Δ
Lockfiles	297	298	+1
Total bytes	45,271,436	45,439,756	+168,320
workflow_dispatch	289	290	+1
schedule	240	241	+1
create_pull_request outputs	63	64	+1
codex engine	75	76	+1
max steps/workflow	202	205	+3
max script steps/workflow	133	136	+3
playwright MCP server	1 workflow	0 workflows	-1

Recommendations

• Consider standardizing the long tail of unique cron schedules where feasible, to smooth CI/API load rather than clustering at specific minute/hour offsets.
• Since agent-job permissions are already minimal by construction, focus any future permission audit on the safe-outputs writer job(s), where issues: write is universal and contents: write covers 205/298 workflows.
• No malformed lockfiles or detection gaps this run — the analyzer pipeline needs no changes for this schema version (v4).

Methodology note

single-script compact JSON analysis

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by 📊 Lockfile Statistics Analysis Agent · claude · agent · 75.2 AIC · ⌖ 8.22 AIC · ⊞ 8.5K · ◷

• expires on Sep 2, 2026, 12:29 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Lockfile Statistics Analysis Agent.

A newer discussion is available at Discussion #58025.