[lockfile-stats] Lockfile Statistics Audit — 2026-10-20

[github-actions[bot]]

Executive summary

• 345 compiled .lock.yml workflows audited (345/345 parsed, 0 skipped) as of 2026-10-20
• Total size 59,905,003 bytes (~57.1 MB), avg 173,638 B, min 95,985 B, max 309,399 B
• vs prior day (2026-10-19, 344 workflows): +1 workflow, +2.40 MB total, avg size +3.9%

File size distribution

Metric	Value
Count	345
Total	59,905,003 B
Avg	173,637.7 B
Min	95,985 B
Max	309,399 B

Trigger analysis

Trigger	Count
workflow_dispatch	335
schedule	251
pull_request	47
workflow_call	5
issues	5
issue_comment	3
push	2
deployment_status / workflow_run / discussion / discussion_comment / repository_dispatch / pull_request_review_comment	1 each

Top combinations: schedule+workflow_dispatch (214), workflow_dispatch only (71), pull_request+schedule+workflow_dispatch (33). Most common cron: 0 0 */2 * * (60 workflows, every 2 hours).

Safe outputs analysis

Top types (workflow counts): create_issue 183, create_discussion 92, add_comment 74, create_pull_request 66, push_repo_memory 33, add_labels 32.

Discussion-category detection: create_discussion_workflows = 93, discussion_category_detected = 92 (99% resolved, well within the 10% tolerance). 1 workflow unresolved: pr-sous-chef.lock.yml. Categories: audits (79), announcements (5), artifacts (2), dev (2), research (2), general (1), daily-news (1).

safe_outputs_config_missing = 1/345 (not all, so detection is working; this is a workflow with no safe-outputs config, not a parse failure).

Structural characteristics

Metric	Total	Max
Jobs	2,794	24
Steps	52,494	333
Script (run:) steps	22,228	97

Permission patterns (agent job)

Scope	Read	Write
contents	345	0
copilot-requests	0	168
issues	261	0
pull-requests	255	0
discussions	52	0
actions	139	0
security-events	15	0
id-token	0	4

permissions_unknown = 0/345, every lockfile's agent-job permissions resolved cleanly.

Union-of-all-jobs write grants: 345/345 workflows (100%) grant some write scope across their full job set once non-agent jobs (e.g. safe-output writer jobs) are included, up from 342/344 yesterday.

Engine distribution

Engine	Count
copilot	143
codex	76
claude	62
pi	38
aider	4
goose	4
agy	3
opencode	3
crush / cursor / deepseek-harness / gemini / kiro / pydantic-ai	2 each

engine_unknown = 0/345, agent_id resolved for every lockfile via gh-aw-metadata.

Tool & MCP patterns

MCP server	Workflows
safeoutputs	320
github	193
work-queue	33
agenticworkflows	27
mcpscripts	25
serena	15

mcp_fallback_count = 7 (legacy lockfiles without a gh-aw-manifest block, scraped from mcp__ tool comments).

Interesting findings

1. copilot overtook codex and claude individually as the single most common engine (143 of 345, 41%), nearly double the next-largest (codex, 76).
2. 100% of workflows now grant a write scope somewhere in their job graph (union across jobs), even though the primary agent job itself is write-scope-free for every content/issue/PR permission except copilot-requests and id-token, confirming the write-isolation pattern: the agent job stays read-only while a separate job performs safe-output writes.
3. The id-token union-write count jumped from 5 to 345 between yesterday and today while the agent-job-level id-token write count stayed flat at 4. This is a large, suspicious single-day swing that should be spot-checked against the underlying lockfiles rather than taken at face value; it may reflect a detection change rather than a real permission shift.
4. Bimodal cron scheduling: the dominant cadence is every 2 hours (0 0 */2 * *, 60 workflows); the long tail is roughly 190 distinct one-off cron strings, so most scheduled workflows cluster on a shared cadence while a large minority use bespoke schedules.
5. copilot-requests:write (168 workflows) has no corresponding read grant anywhere, a write-only scope consistent with it being a billing/budget permission rather than a readable resource.

Historical trends (vs 2026-10-19)

Metric	2026-10-19	2026-10-20	Delta
Lockfiles	344	345	+1
Total bytes	57,504,798	59,905,003	+2,400,205 (+4.2%)
Avg bytes	167,165.1	173,637.7	+6,472.6 (+3.9%)
Total jobs	2,441	2,794	+353 (+14.5%)
Total steps	51,302	52,494	+1,192 (+2.3%)
Script steps	22,149	22,228	+79
copilot engine count	142	143	+1
workflows_with_any_write	342	345	+3
id-token union-write	5	345	+340 (see finding #3)

Recommendations

• Investigate the pr-sous-chef.lock.yml discussion-category resolution gap and the id-token union-write anomaly (finding Add workflow: githubnext/agentics/weekly-research #3) before treating future deltas on that scope as real.
• The +14.5% job-count growth against only +4.2% size growth suggests new/changed workflows are adding jobs more aggressively than content; worth checking whether this is deliberate job-splitting or unintended duplication.
• copilot-requests:write with zero paired read entries is expected for a budget-style permission; no action needed unless a future workflow needs to read its own usage.

Methodology note

Single-script compact JSON analysis: one Python pass over all .lock.yml files produced a compact summary (/tmp/gh-aw/agent/lockfile-stats-summary.json, 4,878 bytes), reasoned over without re-opening individual lockfiles. Engine IDs from gh-aw-metadata, permissions from per-job permissions blocks (not the always-empty top-level block), safe-output/discussion-category data from GH_AW_SAFE_OUTPUTS_CONFIG, MCP usage from gh-aw-manifest. History compared against /tmp/gh-aw/cache-memory/history/2026-10-19.json.

References: §39491575408

Generated by 📊 Lockfile Statistics Analysis Agent · claude · agent · 60.9 AIC · ⌖ 0.897 AIC · ⊞ 6.5K · ◷

• expires on Oct 21, 2026, 12:31 PM UTC-08:00