[lockfile-stats] Lockfile Statistics Audit — 2026-07-28 (265 workflows)

[github-actions[bot]]

Executive Summary

265 compiled .lock.yml workflows analyzed on 2026-07-28 (0 skipped/malformed) — up +4 from the 2026-07-24 run. Total size 33.6 MB (35,279,616 bytes), avg 130.0 KB/file (133,131 bytes).

Metric	Value	Δ vs 2026-07-24
Lockfiles	265	+4
Total bytes	35,279,616	+1,263,885 (+3.7%)
Avg size	133,131 B	+2,803 B
Min / Max size	83,447 B / 214,151 B	+1,334 / +6,095
Total jobs	1,871	+23
Total steps	33,879	+442
Total run scripts	15,027	+199

File Size Distribution

Bucket	Count
100–250 KB	260
50–100 KB	5

Largest: smoke-copilot.lock.yml (214,151 B), smoke-copilot-aoai-entra.lock.yml (193,672 B), smoke-copilot-aoai-apikey.lock.yml (191,367 B)
Smallest: example-permissions-warning.lock.yml (83,447 B), codex-github-remote-mcp-test.lock.yml (83,971 B), firewall.lock.yml (84,386 B)

Trigger Analysis

Trigger	Count
workflow_dispatch	258
schedule	183
pull_request	32
issues	4
issue_comment	2
workflow_call	2
deployment_status / workflow_run / discussion / discussion_comment / push	1 each

Top combinations: schedule+workflow_dispatch (180), workflow_dispatch only (46), pull_request+workflow_dispatch (27).
Workflows with workflow_dispatch: 258/265 (97%).
Cron frequency: highly scattered — no single cron shared by more than 2 workflows (11 crons shared by exactly 2, rest unique), consistent with intentional schedule jitter to avoid thundering-herd runs.

Safe Outputs Analysis

Baseline safe-output tools present in nearly every workflow: create-report-incomplete-issue / missing-data / missing-tool / noop / report-incomplete (260 each). Beyond baseline:

Safe output	Count	Δ
create-issue	123	+2
create-discussion	88	0
add-comment	66	0
create-pull-request	55	+2
push-repo-memory	36	0
upload-asset / add-labels	25 each	0
mentions	21	+2
create-pull-request-review-comment / submit-pull-request-review	15 each	0

Discussion categories: audits (77), announcements (5), artifacts (2), dev (2), daily-news (1), research (1) — unchanged from prior run despite 4 new workflows, meaning new workflows didn't add discussion outputs.

Structural Characteristics

Metric	Min	Max	Avg
Jobs/workflow	4	12 (daily-model-inventory.lock.yml)	7.06
Steps/workflow	79	190 (smoke-copilot.lock.yml)	127.85

Note: the max-jobs record moved from release.lock.yml to daily-model-inventory.lock.yml (both at 12) since the last run.

Permission Patterns

All 265 lockfiles declare permissions: {} at top level (least-privilege pattern), with actual scopes granted per-job.

Read (top)	Count	Write (top)	Count
actions	265	issues	258
contents	265	contents	176
pull-requests	228	pull-requests	125
issues	224	actions	99
discussions	50	discussions	93
security-events	14	copilot-requests	72

copilot-requests write grew 68 → 72 (+4), tracking the new-workflow count exactly — all 4 new workflows use Copilot.

Timeouts: 265 jobs at 31–60 min, 28 at 6–15 min, 2 at ≤5 min. The single >60min outlier job from the prior run is gone this cycle.

Tool & MCP Patterns

Engine	Count	Δ
other (custom/pi)	118	+4
copilot	66	0
claude	63	0
codex	15	0
antigravity / gemini / opencode	1 each	0

All 4 new workflows landed in the "other" engine bucket, not the named claude/copilot/codex/gemini engines.

MCP server	Count
github	101
serena	24
tavily / sentry	5 each
grafana / markitdown	3 each
ast-grep / arxiv / deepwiki / notion / datadog / microsoftdocs	2 each

Notable: brave-search MCP usage dropped from 2 → 0 — no workflow currently references it (likely migrated to tavily/github search or removed).

Interesting Findings

1. New-workflow signature is consistent: all 4 workflows added since 2026-07-24 use the Copilot engine (copilot-requests write +4, engine "other" +4) and none add discussion/issue safe-outputs beyond the existing category set — suggesting they're audit/report-style additions similar to existing ones.
2. workflow_dispatch is near-universal (97% of workflows) — manual re-run capability is a strict house convention, not an exception.
3. Schedule jitter is deliberate: of 183 scheduled workflows, only 11 cron expressions repeat (each exactly twice), and none more than twice — strong evidence of intentional load-spreading rather than default 0 0 * * *-style schedules.
4. brave-search MCP server usage went to zero this cycle after being present in 2 workflows previously — worth confirming this was an intentional removal/migration rather than a compile regression.
5. Size growth (+3.7% total bytes, +4 files) is proportionate — avg bytes/workflow rose only ~2.1%, indicating new workflows are similarly-sized to existing ones rather than unusually large, and growth is primarily driven by workflow count, not lockfile bloat.

Historical Trends (vs 2026-07-24)

Metric	2026-07-24	2026-07-28	Δ
Lockfiles	261	265	+4
Total bytes	34,015,731	35,279,616	+3.7%
Total jobs	1,848	1,871	+23
Total steps	33,437	33,879	+442
create-issue	121	123	+2
create-pull-request	53	55	+2
mentions	19	21	+2
copilot-requests (write)	68	72	+4
brave-search MCP	2	0	-2
>60min timeout jobs	1	0	-1

Recommendations

• Confirm whether the brave-search MCP server removal was intentional; if accidental, workflows relying on it may now silently lack that capability.
• Since copilot-requests write permission tracks new-workflow count 1:1, consider whether Copilot-engine workflows should get a shared/reusable permission template to reduce duplication across the growing "other" engine bucket (118 workflows, the largest single bucket).
• The discussion-category set (6 categories) hasn't grown despite +4 workflows and +2 create-discussion-adjacent outputs elsewhere — verify new audit-style workflows that should post to audits are correctly configured if that was intended.

Methodology: single-script compact JSON analysis (cached analyzer at /tmp/gh-aw/cache-memory/scripts/lockfile_stats_v1.py, summary at /tmp/gh-aw/agent/lockfile-stats-summary.json, historical snapshots under /tmp/gh-aw/cache-memory/history/).

Generated by 📊 Lockfile Statistics Analysis Agent · age00 · 58.2 AIC · ⌖ 5.56 AIC · ⊞ 5.5K · ◷

• expires on Jul 29, 2026, 12:43 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Lockfile Statistics Analysis Agent.

A newer discussion is available at Discussion #48977.