[lockfile-stats] Lockfile Statistics Report — 2026-10-19 (344 workflows)

[github-actions[bot]]

Lockfile Statistics — 2026-10-19

Overview of all compiled agentic workflow lockfiles in .github/workflows/*.lock.yml, generated via single-script compact JSON analysis.

Executive summary

Metric	Value
Lockfiles analyzed	344 (0 skipped/malformed)
Total size	57,504,798 bytes (~54.8 MB)
Avg / min / max size	167,165 B / 91,234 B / 303,150 B
Jobs (total / max per workflow)	2,441 / 23
Steps (total / max per workflow)	51,302 / 330
Script steps (total / max per workflow)	22,149 / 97

File size distribution

Sizes cluster tightly: avg 167 KB vs. max 303 KB (~1.8x avg) and min 91 KB (~0.55x avg) — most lockfiles share a similar scaffold/boilerplate footprint rather than varying by workflow complexity.

Trigger analysis

Trigger	Workflows	%
workflow_dispatch	335	97%
schedule	251	73%
pull_request	47	14%
workflow_call	5	1%
issues	5	1%
issue_comment	3	<1%
push	2	<1%

Top trigger combinations: schedule+workflow_dispatch (214), workflow_dispatch only (71), pull_request+schedule+workflow_dispatch (33).

Most common cron: 0 0 */2 * * (every 2 days) — 60 workflows, by far the dominant schedule pattern.

Safe outputs analysis

337 workflows carry the baseline safety-net tools (missing_data, missing_tool, noop, report_incomplete). Beyond that baseline:

Safe output type	Count
create_issue	182
create_discussion	92
add_comment	74
create_pull_request	66
push_repo_memory	33
add_labels	32
upload_asset	26

Discussion categories (92 of 93 create_discussion workflows resolved; 1 unresolved — pr-sous-chef.lock.yml, config present but no parseable category):

Category	Count
audits	79
announcements	5
artifacts	2
dev	2
research	2
general	1
daily-news	1

Self-check: create_discussion_workflows=93, discussion_category_detected=92 (99% — within tolerance), safe_outputs_config_missing=1 (not all-344, so detection is healthy, not broken).

Permission patterns (agent job)

Read-only is the norm at the agent-job level — the agent job never directly requests write:

Scope	Read	Write (agent job)
contents	344 (100%)	0
issues	261	0
pull-requests	255	0
discussions	52	0
actions	139	0
copilot-requests	0	167
security-events	14	0

copilot-requests: write (167) is the only scope the agent job itself ever grants write for — a billing/usage permission distinct from content-mutating scopes.

Union across all jobs (agent + safe-output handler jobs) tells a different story: 342/344 workflows (99.4%) grant some write scope once handler jobs are included — issues (342), contents (230), copilot-requests (167), pull-requests (153), discussions (97). This confirms the intended design: mutations happen in dedicated safe-output jobs, not the agent job itself.

permissions_unknown = 0 — permission extraction succeeded for all 344 lockfiles.

Engine distribution

Engine	Count	%
copilot	142	41%
codex	76	22%
claude	62	18%
pi	38	11%
aider	4	1%
goose	4	1%
agy	3	<1%
opencode	3	<1%
crush, cursor, deepseek-harness, gemini, kiro, pydantic-ai	2 each	<1%

engine_unknown = 0 — every lockfile resolved via gh-aw-metadata agent_id.

Tool & MCP patterns

MCP server	Workflows
safeoutputs	320 (93%)
github	193 (56%)
work-queue	33
agenticworkflows	27
mcpscripts	25
serena	15

7 lockfiles had no gh-aw-manifest and fell back to legacy # - mcp__... comment scraping.

Interesting findings

1. Write access is fully delegated: 0 agent jobs request direct write permissions for content-mutating scopes (contents, issues, pull-requests, discussions) — all mutation happens through safe-output handler jobs. This is strong evidence the safe-outputs isolation model is consistently applied repo-wide.
2. Copilot is the plurality engine (41%, 142 workflows), followed by codex (22%) and claude (18%) — together these three cover 81% of all workflows.
3. 0 0 */2 * * dominates scheduling (60 workflows, every-other-day cadence) — far more common than any other cron pattern, suggesting a shared template default rather than per-workflow tuning.
4. Discussion category audits is overwhelmingly dominant (79 of 92 resolved, 86%) — this very report's category included — indicating most create_discussion usage in this repo is for audit-style reporting rather than announcements or Q&A.
5. One persistent unresolved discussion category (pr-sous-chef.lock.yml) has appeared in prior runs too — its safe-outputs config has a create_discussion entry without a category key resolvable by the primary parser, worth a manual check.

Historical trends (vs. 2026-10-18)

Metric	2026-10-18	2026-10-19	Δ
Lockfiles	345	344	-1
Total bytes	57,702,451	57,504,798	-197,653
Jobs (total)	2,446	2,441	-5
Steps (total)	51,510	51,302	-208
Script steps (total)	22,211	22,149	-62
codex engine	77	76	-1
create_issue workflows	183	182	-1
MCP: safeoutputs	321	320	-1
MCP: github	194	193	-1
union pull-requests write	152	153	+1
union discussions write	96	97	+1

Net change is consistent with one codex-engine workflow being removed (accounts for the -1 lockfile, -1 codex, and the broad -1 shifts across triggers/jobs/steps/MCP usage). The small +1 upticks in union pull-requests write and discussions write don't fit that single-removal story and point to a separate permission change in another existing workflow — worth a quick diff check if precision matters.

Recommendations

• Investigate the pr-sous-chef.lock.yml unresolved discussion category to close the long-standing 1-workflow gap in category detection.
• Consider documenting the 0 0 */2 * * cron default explicitly if it is in fact a shared template, since 60/251 scheduled workflows (24%) use it verbatim.
• No permission-model regressions detected: write access remains fully isolated to safe-output handler jobs across all 344 lockfiles.

Methodology

single-script compact JSON analysis — one analyzer script (lockfile_stats_v4.py, cached and reused from /tmp/gh-aw/cache-memory/scripts/) parsed all lockfiles once into a compact summary JSON; all figures above are derived from that summary only, with a same-day historical comparison against /tmp/gh-aw/cache-memory/history/2026-10-18.json.

Generated by 📊 Lockfile Statistics Analysis Agent · claude · agent · 49.1 AIC · ⌖ 0.839 AIC · ⊞ 6.5K · ◷

• expires on Oct 20, 2026, 12:30 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Lockfile Statistics Analysis Agent.

A newer discussion is available at Discussion #70624.