[lockfile-stats] Lockfile Statistics — 2026-10-03 (319 lockfiles, +17 vs prior snapshot)

[github-actions[bot]]

Lockfile Statistics — 2026-10-03

Analysis of 319 .github/workflows/*.lock.yml files (0 malformed/skipped), totaling 49,594,057 bytes (~47.3 MB). Methodology: single-script compact JSON analysis (lockfile_stats_v4.py, cached in cache-memory/scripts/).

Key metrics

Metric	Value
Lockfiles	319
Total size	49,594,057 bytes (47.3 MB)
Avg / min / max size	155,467 / 85,618 / 253,822 bytes
Avg jobs / max jobs	7.19 / 14
Avg steps / max steps	144.02 / 212
Avg scripts / max scripts	99.91 / 142
workflow_dispatch present	311 (97.5%)
create_discussion workflows	92 (category detection: 92/92, 100%)
Safe-outputs config missing	1 lockfile

File size distribution

Sizes cluster tightly: avg 155 KB with a 85.6–253.8 KB range (2.96x spread). No single lockfile dominates; the distribution looks like steady per-workflow boilerplate (safe-outputs scaffolding) plus variable per-workflow prompt/tooling content.

Trigger analysis

Trigger counts and top combinations

Trigger	Count
workflow_dispatch	311
schedule	249
pull_request	43
issues	5
issue_comment	3
workflow_call	3
deployment_status	1
workflow_run	1
discussion	1
discussion_comment	1
push	1
pull_request_review_comment	1

Top trigger combinations: schedule+workflow_dispatch (216, 67.7%), workflow_dispatch only (51, 16.0%), pull_request+schedule+workflow_dispatch (29), pull_request+workflow_dispatch (9).

Top cron cadence: 0 0 */2 * * (every 2 days) — 46 workflows, by far the most common schedule.

Safe outputs analysis

Safe-output type counts (top 15 of 56 types)

Type	Count
create_report_incomplete_issue / missing_data / missing_tool / noop / report_incomplete	312 each
create_issue	163
create_discussion	92
add_comment	75
create_pull_request	65
push_repo_memory	35
add_labels	32
upload_asset	26
mentions	23
create_pull_request_review_comment / submit_pull_request_review	16 each
upload_artifact / create_check_run	14 each

Discussion categories (92 create_discussion workflows, 100% category-detected, 0 fallback-parsed, 0 unresolved):

Category	Count
audits	79 (85.9%)
announcements	5
artifacts	2
dev	2
research	2
general	1
daily-news	1

Structural characteristics

• Jobs: avg 7.19, max 14
• Steps: avg 144.02, max 212
• Scripts: avg 99.91, max 142

Permission patterns (agent job only — top-level permissions:{} carries no signal)

Agent job permissions by scope

Scope	read	write	none
contents	319	0	0
issues	262	0	57
pull-requests	256	0	63
actions	115	0	204
discussions	53	0	266
security-events	14	0	305
deployments	1	0	318
packages	1	0	318
id-token	0	2	317
checks / pages / repository-projects / statuses / attestations	0	0	319

Union across all jobs (any job in the workflow granting the scope): issues:write appears in all 319 workflows (100%) — the safe-outputs dispatcher job universally requires issue-write scope. contents is write in 210 (65.8%), read-only in 109. union_any_write_count = 319 (every workflow has at least one write-capable job).

Engine distribution

(derived from gh-aw-metadata agent_id; 0 unresolved)

Engine	Count	Share
copilot	129	40.4%
codex	78	24.5%
claude	57	17.9%
pi	32	10.0%
aider	4	1.3%
goose	4	1.3%
opencode	3	0.9%
crush / cursor / deepseek-harness / gemini / kiro / pydantic-ai	2 each	0.6% each

Tool & MCP patterns

MCP servers: safeoutputs (319, 100%), github (192, 60.2%), agenticworkflows (44), serena (25), mcpscripts (25), tavily (5), long tail of 11 others at ≤4. mcp_fallback_used_count = 0 (manifest-based detection worked for every lockfile).

Most-used tools: github:get_commit/get_file_contents/etc. (184 each, the read-only baseline toolkit), safeoutputs:create_issue (164), github:get_me (159), safeoutputs:create_discussion (92).

Interesting findings

1. Schedule cadence is concentrated: 0 0 */2 * * (every 2 days) alone accounts for 46 of 249 scheduled workflows (18.5%) — far ahead of any other cron pattern, suggesting a strong default convention rather than organic diversity.
2. Safe-output error-handling scaffolding is now near-universal: noop/missing_tool/missing_data/report_incomplete appear in 312/319 workflows (97.8%), up from 296/302 (98.0%) last snapshot — this contract is being adopted as a default, not an opt-in.
3. issues:write is a universal union permission (319/319) despite only 262 agent jobs reading issues directly — every workflow's safe-outputs job requests issue-write regardless of whether the workflow creates issues.
4. Engine long tail grew in lockstep: all nine minor engines (aider, goose, opencode, crush, cursor, deepseek-harness, gemini, kiro, pydantic-ai) each gained exactly +1 this cycle, while create_discussion_workflows stayed flat at 92 — consistent with one new multi-engine comparison workflow bundle rather than broad diversification.
5. Discussion category detection is fully resolved (92/92, 0 unresolved, 0 fallback-parsed) and overwhelmingly dominated by audits (85.9%) — this very analyzer is representative of the typical discussion-producing workflow, not an outlier.

Historical trends (vs. 2026-10-02)

Metric	2026-10-02	2026-10-03	Δ
Lockfiles	302	319	+17 (+5.6%)
Total bytes	47,558,962	49,594,057	+2,035,095 (+4.3%)
Avg size	157,480.0	155,467.3	−2,012.7 (−1.3%)
workflow_dispatch count	294	311	+17
create_issue	148	163	+15
Baseline scaffolding (noop etc.)	296	312	+16
create_discussion_workflows	92	92	0
Avg jobs	7.35	7.19	−0.16
Avg steps	146.23	144.02	−2.21
copilot engine	127	129	+2
codex engine	74	78	+4
claude engine	56	57	+1

Two safe-output types disappeared entirely this cycle: approve_workflow_run (1→0) and dismiss_pull_request_review (1→0, down from 2 last-last cycle), while publish-essential-issues appeared for the first time (0→1).

Recommendations

• Identify the 7 workflows (319 − 312) still lacking baseline noop/missing_tool/missing_data safe-output handling and backfill for consistency.
• Confirm the 1 lockfile with no GH_AW_SAFE_OUTPUTS_CONFIG at all is an intentional minimal workflow, not a compile regression.
• Document issues:write as an expected baseline union permission (required by the safe-outputs dispatcher job) rather than a per-workflow design choice.
• Treat the 212-step / 142-script maximum workflow as a candidate for splitting if compile or runtime latency becomes a concern.

References:

• §37154097945

Generated by 📊 Lockfile Statistics Analysis Agent · claude · agent · 60.6 AIC · ⌖ 6.74 AIC · ⊞ 6.4K · ◷

• expires on Oct 4, 2026, 1:14 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Lockfile Statistics Analysis Agent.

A newer discussion is available at Discussion #65664.