[lockfile-stats] Lockfile Statistics Analysis — 2026-08-31

[github-actions[bot]]

Lockfile Statistics — 2026-08-31

Analysis of all compiled .github/workflows/*.lock.yml files in github/gh-aw. Methodology: single-script compact JSON analysis (cached analyzer, schema v4). 0 malformed/skipped files; self-check passed (engine, permission, and discussion-category extraction all resolved with no unresolved gaps).

Executive summary

Metric	Value
Lockfiles analyzed	297
Total size	45,271,436 bytes (~43.2 MB)
Avg / min / max size	152,429 / 91,817 / 241,824 bytes
Jobs per workflow (avg / max)	7.33 / 14
Steps per workflow (avg / max)	144.17 / 202
Inline script steps (avg / max)	99.26 / 133

File size distribution

Sizes cluster tightly around the mean (~152 KB), with only a small tail toward the 240 KB max — consistent with most workflows sharing the same generated boilerplate (safe-outputs handlers, MCP scaffolding) plus workflow-specific prompt/script content.

Trigger analysis

Trigger	Count
workflow_dispatch	289
schedule	240
pull_request	43
issues	5
issue_comment	3
workflow_call	3
discussion / discussion_comment / push / workflow_run / deployment_status / pull_request_review_comment	1 each

Dominant trigger combination: schedule + workflow_dispatch (207 workflows, 70%), followed by workflow_dispatch-only (38) and pull_request + schedule + workflow_dispatch (29). The most common cron is 0 0 */2 * * (every 2 days), used by 42 workflows — a strong outlier versus the long tail of once-daily/weekday crons.

Safe outputs analysis

Every workflow ships the standard safety scaffolding (missing_data, missing_tool, noop, report_incomplete at 291/297 each). Beyond that baseline, the most common write-producing safe outputs are:

Safe output	Count
create_issue	145
create_discussion	92
add_comment	77
create_pull_request	63
push_repo_memory	34
add_labels	32

Discussion categories (92 create_discussion workflows, all 92 resolved to a category):

Category	Count
audits	79
announcements	5
artifacts	2
dev	2
research	2
general	1
daily-news	1

Permission patterns (agent job)

Derived from jobs.agent.permissions (the top-level permissions: {} block carries no signal and was ignored):

Scope	read	write	none
contents	297	0	0
issues	259	0	38
pull-requests	254	0	43
discussions	52	0	245
actions	112	0	185
security-events	14	0	283
id-token	0	2	295

The agent job itself is almost entirely read-only — writes happen via the safe-outputs handler job instead. Union-across-all-jobs permissions show all 297 workflows grant at least one write scope somewhere in the job graph (mostly issues: write at 297/297, contents: write at 204/297).

Engine distribution

Engine	Count
copilot	120
codex	75
claude	56
pi	29
crush / aider / opencode / goose	3 each
cursor / deepseek-harness / gemini / kiro / pydantic-ai	1 each

0 workflows had an unresolvable engine. Top models: openai/gpt-5.4 (49), copilot/mai-code-1-flash-picker (44), copilot/claude-sonnet-4.5 (12).

Tool & MCP patterns

safeoutputs MCP appears in all 297 workflows (as expected). Beyond that: github (120), agenticworkflows (44), serena (25), mcpscripts (12), tavily (5), sentry (3). No fallback tool-comment parsing was needed — all servers resolved via the gh-aw-manifest metadata line.

Interesting findings

1. Zero detection gaps — engine, permission, and discussion-category extraction resolved 100% of applicable workflows; no fallback regex parsing was required anywhere.
2. Cadence outlier — the 0 0 */2 * * (every-2-days) cron dominates at 42 workflows, far more than any other single schedule, suggesting a shared default rather than per-workflow tuning.
3. Read-heavy agent jobs — the agent job almost never holds write permissions directly (e.g., 0/297 with contents: write); all mutation flows through the dedicated safe-outputs handler job, matching the intended security boundary of the framework.
4. Copilot leads engine adoption (120/297, 40%), followed by codex (75) and claude (56) — a notably diverse engine mix for one repository.
5. create_discussion category concentration — 79 of 92 discussion-producing workflows (86%) post to the audits category, this one included.

Historical trends (vs. 2026-08-30)

Quiet day — no structural changes. Only file sizes shifted marginally:

Metric	2026-08-30	2026-08-31	Δ
Total bytes	45,259,779	45,271,436	+11,657
Avg size	152,389.8	152,429.1	+39.3
Max size	239,880	241,824	+1,944
Lockfile count	297	297	0

All trigger, safe-output, permission, engine, and MCP distributions were byte-for-byte identical to the prior day.

Recommendations

• Consider whether the 42-workflow 0 0 */2 * * cadence is intentional per-workflow or an unreviewed default — worth auditing if these workflows have divergent freshness needs.
• The discussions: write union count (96) vs. create_discussion config count (92) suggests a handful of workflows carry discussion-write permission without an active create_discussion safe output — low priority, but worth a permissions-tightening pass.

References: §33435610149

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by 📊 Lockfile Statistics Analysis Agent · claude · agent · 76.3 AIC · ⌖ 8.43 AIC · ⊞ 8.5K · ◷

• expires on Sep 1, 2026, 12:29 PM UTC-08:00