[lockfile-stats] Lockfile Statistics Audit — 2026-08-11 (285 workflows)

[github-actions[bot]]

Lockfile Statistics Audit — 2026-08-11

Analyzed all 285 compiled .github/workflows/*.lock.yml files (0 skipped, 0 malformed). Methodology: single-script compact JSON analysis (PyYAML safe_load + targeted marker extraction for engine/safe-outputs/MCP fields).

Headline: Copilot is now the majority engine (60%), 97.5% of workflows are manually dispatchable, and lockfile size is dominated by bundled runtime tooling rather than workflow-specific logic.

Key metrics

Metric	Value
Lockfiles analyzed	285 (0 skipped)
Total size	39,696,008 bytes (~37.9 MiB)
Avg / min / max size	139,284 / 82,777 / 221,778 bytes
Total jobs / avg / max	2,090 / 7.33 / 14
Total steps / avg / max	39,401 / 138.25 / 198
Total script-like steps / avg / max	27,436 / 96.27 / 133
workflow_dispatch enabled	278 / 285 (97.5%)

File size distribution

Largest lockfiles are dominated by smoke-test workflows exercising multiple engine/auth variants, plus a couple of "deep" analysis workflows:

Workflow	Bytes
smoke-copilot-aoai-entra	221,778
smoke-copilot	220,787
smoke-copilot-aoai-apikey	219,175
deep-report	190,484
smoke-claude	186,274
smoke-copilot-arm	180,043
issue-monster	175,401

Trigger analysis

Trigger	Count
workflow_dispatch	278
schedule	194
pull_request	39
issues	4
workflow_call	2
issue_comment	2
discussion	1
discussion_comment	1
push	1
workflow_run	1
deployment_status	1

Top trigger combinations: schedule + workflow_dispatch (191, 67%), workflow_dispatch only (48, 17%), pull_request + workflow_dispatch (34, 12%). Cron schedules are almost all unique per-workflow (only one cron string, 7 5 * * *, repeats — 3 times); the rest cluster loosely in the 03:00–06:00 UTC band, consistent with staggered daily batch jobs.

Safe outputs analysis

Extracted from each workflow's actual configured tool-constraint block (not just string presence), so counts reflect real usage rather than embedded-library noise:

Safe output type	Workflows
create-issue	137
create-discussion	92
add-comment	72
create-pull-request	58
add-labels	30
upload-asset	26
create-pull-request-review-comment	16
submit-pull-request-review	16
create-check-run	14
update-issue	10
remove-labels	7
close-issue / update-pull-request / assign-to-agent	5 each
link-sub-issue / close-pull-request	4 each
close-discussion / reply-to-pull-request-review-comment	3 each

Discussion categories (of the 92 create-discussion configs): audits 79 (86%), announcements 5, artifacts 2, dev 2, research 2, general 1, daily-news 1.

Structural characteristics

• 2,090 jobs across 285 workflows (avg 7.33/workflow, max 14) — reflects the standard activation → agent → safe-output-processing job pipeline plus per-workflow extras.
• 39,401 steps total (avg 138/workflow) and 27,436 script-like (run:/github-script) steps (avg 96/workflow) — most step volume is generated runtime scaffolding, not hand-authored logic.
• Timeout ceilings: 45 min (286 job-level settings), 10 min (29), 5 min (2) — 45 minutes is the near-universal default.

Permission patterns

Scope	Read	Write
contents	1,248	393
actions	681	108
issues	241	642
pull-requests	253	320
discussions	50	191
copilot-requests	—	224
security-events	14	9
checks	1	28
id-token / attestations / packages / statuses	rare (≤4 each)	rare (≤4 each)

contents: read and issues: write are the two most-granted permissions overall; sensitive/broad scopes (id-token, attestations, packages write) stay in the single digits, indicating tight scoping on average.

Tool & MCP patterns

Engine distribution (285 workflows, one engine each):

Engine	Count	Share
copilot	172	60.4%
claude	60	21.1%
pi	22	7.7%
codex	15	5.3%
crush / aider / opencode / goose	3 each	4.2% combined
cursor / gemini / kiro / pydantic-ai	1 each	1.4% combined

MCP server usage:

Server	Workflows
safeoutputs	285 (universal)
github	117
agenticworkflows	42
serena	25
mcpscripts	12
tavily	5
sentry / guard-policies*	3 each
ast-grep / datadog / deepwiki / microsoftdocs / grafana	2 each

* "guard-policies" is a config sub-key, not a distinct server; low-count noise from the extraction heuristic.

Interesting findings

1. Copilot has overtaken Claude as the dominant engine (60% vs 21% of workflows) — a notable shift for a repo whose smoke-test suite still names Claude-specific variants explicitly.
2. Manual dispatch is nearly universal (97.5%) even though 68% of workflows are also scheduled — almost every autonomous daily job keeps a human-triggerable escape hatch.
3. create-issue and create-discussion dominate safe outputs, and audits is the runaway top discussion category (86% of discussion-producing workflows) — this analyzer's own convention (create-discussion into audits) is the norm, not a special case.
4. Lockfile size is driven by bundled tooling, not workflow logic: the largest files are smoke/deep-analysis workflows exercising multiple engine or MCP-server variants; average size (~136 KiB) reflects embedded MCP gateway/safe-outputs runtime code repeated per file.
5. Permission scoping looks disciplined: broad/sensitive scopes (id-token, attestations, packages) appear in ≤4 workflows each, while the bulk of grants cluster around contents, issues, and pull-requests — the resources these workflows actually act on.

Historical trends

No prior snapshot existed in /tmp/gh-aw/cache-memory/history/ before this run — this report establishes the baseline (2026-08-11.json). Future runs should diff against it to track engine-mix shifts, safe-output growth, and lockfile size drift.

Recommendations

• Track the Copilot-vs-Claude engine mix over time; with Copilot now the majority engine, confirm smoke-test coverage (smoke-copilot-*) keeps pace with new Copilot-specific behavior.
• Investigate whether the ~39.7 MB total lockfile footprint (driven by repeated bundled MCP/safe-outputs runtime code) can be reduced via shared includes, since it scales with tooling surface rather than workflow-specific complexity.
• Revisit the 45-minute default job timeout — it applies to the vast majority of jobs (286 of ~317 timeout settings); confirm it isn't systematically oversized for lightweight jobs.
• Re-run this audit on a recurring cadence (e.g., weekly) now that a baseline exists, to catch drift in engine adoption, safe-output usage, and permission scope creep early.

Methodology note: single-script compact JSON analysis — one Python pass over all lockfiles building /tmp/gh-aw/agent/lockfile-stats-summary.json, reasoned from that compact summary only (no per-file cat/grep review).

Generated by 📊 Lockfile Statistics Analysis Agent · agent · 72.4 AIC · ⌖ 29.1 AIC · ⊞ 5.8K · ◷

• expires on Aug 12, 2026, 12:32 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Lockfile Statistics Analysis Agent.

A newer discussion is available at Discussion #52352.