[lockfile-stats] Lockfile Statistics Audit — 2026-07-29

[github-actions[bot]]

Methodology: single-script compact JSON analysis of .github/workflows/*.lock.yml (PyYAML safe_load_all primary parse, regex fallback for safe-output/engine/MCP detection). 266 lockfiles parsed, 0 skipped.

Executive Summary

Metric	Value	Δ vs 2026-07-28
Lockfiles	266	+1
Total bytes	36,102,261 (34.4 MB)	+822,645
Avg size	135,723 B	+2,592
Min / Max size	83,373 / 216,020 B	max +1,869
Total jobs	1,942	+71
Total steps	34,868	+989
Total scripts	15,388	+361

File Size Distribution

Bucket	Count
100–250 KB	261
50–100 KB	5

Largest: smoke-copilot-aoai-entra.lock.yml (216,020 B) — new #1, up from 4th place yesterday. Smallest: example-permissions-warning.lock.yml (83,373 B).

Trigger Analysis

Trigger	Count
workflow_dispatch	259
schedule	184
pull_request	32
issues	4
issue_comment	2
workflow_call	2
discussion / discussion_comment / push / workflow_run / deployment_status	1 each

Top combinations: schedule+workflow_dispatch (181), workflow_dispatch only (46), pull_request+workflow_dispatch (27).

Cron cadence is dominated by daily jobs (* * * patterns); several */6 and */4 hour-interval jobs and one weekly (0 0 */7 * *) exist. 259/266 workflows (97%) expose workflow_dispatch for manual runs.

Safe Outputs Analysis

Safe output	Count
create-issue	124
create-discussion	88
add-comment	66
create-pull-request	55
push-repo-memory	36
upload-asset / add-labels	25 each
create-pull-request-review-comment / submit-pull-request-review	15 each
update-issue	10

missing-tool, missing-data, noop, report-incomplete scaffolding present in 261/266 workflows — near-universal safe-output guardrail adoption.

Discussion categories used: audits (77), announcements (5), artifacts (2), dev (2), daily-news (1), research (1) — unchanged from prior day.

Structural Characteristics

Metric	Min	Max	Avg
Jobs/workflow	4	14 (release.lock.yml)	7.3
Steps/workflow	79	190 (smoke-copilot.lock.yml)	131.1

release.lock.yml overtook daily-model-inventory.lock.yml (12 jobs) as the most job-heavy workflow, now at 14 jobs.

Permission Patterns

Read: actions (266), contents (266), pull-requests (229), issues (225), discussions (50), security-events (14).
Write: issues (259), contents (186, +10 vs prior day), pull-requests (125), actions (99), discussions (93), copilot-requests (74).

All 266 workflows use scoped (non-empty-object) top-level permission blocks — no bare permissions: {} at repo-wide default.

Timeouts: 31–60 min (266 jobs bucket), 6–15 min (28), ≤5 min (2).

Tool & MCP Patterns

Engines: other/custom (117), copilot (68, +2), claude (63), codex (15), antigravity/gemini/opencode (1 each).
MCP servers: github (102, +1), serena (24), tavily (5), sentry (5), grafana (3), markitdown (3), ast-grep/arxiv/deepwiki/notion/datadog/microsoftdocs (2 each), semgrep/agentdb/context7/memory (1 each).

Interesting Findings

1. Copilot engine is closing in on Claude — 68 vs 63 workflows, and copilot grew +2 day-over-day while claude held steady.
2. release.lock.yml jumped to the most complex workflow (14 jobs), surpassing daily-model-inventory.lock.yml — worth checking if this reflects an intentional release-pipeline expansion.
3. 97% of workflows are manually triggerable via workflow_dispatch, reinforcing that scheduled automation is paired with an operator escape hatch almost everywhere.
4. GitHub MCP dominates tool usage (102/266 workflows, 38%) far ahead of the next most common server (serena, 24) — most agentic workflows are GitHub-context-bound rather than external-API-bound.
5. Growth is broad-based, not concentrated: +1 lockfile, +71 jobs, +989 steps, +361 scripts day-over-day — consistent with incremental expansion across many existing workflows rather than one large new addition.

Historical Trends (vs 2026-07-28)

Metric	07-28	07-29	Δ
Lockfiles	265	266	+1
Total bytes	35,279,616	36,102,261	+822,645
Total jobs	1,871	1,942	+71
Total steps	33,879	34,868	+989
Total scripts	15,027	15,388	+361
Avg jobs/workflow	7.06	7.30	+0.24
Avg steps/workflow	127.85	131.08	+3.23
Copilot engine count	66	68	+2
create-issue safe output	123	124	+1

Recommendations

• Monitor release.lock.yml's job count growth (12→14 over recent history) to ensure release pipeline complexity stays maintainable.
• With copilot-engine adoption trending up (+2/day), consider whether documentation/tooling parity between claude and copilot engine paths needs attention.
• The near-universal (261/266) missing-tool/missing-data/noop safe-output scaffolding suggests these are now boilerplate — a good candidate for template/generator consolidation if not already centralized.
• Continue day-over-day snapshots in /tmp/gh-aw/cache-memory/history/ to track drift; 5 days of history now available (07-21 through 07-29, minus gaps).

Generated by 📊 Lockfile Statistics Analysis Agent · age00 · 36.1 AIC · ⌖ 15.7 AIC · ⊞ 5.8K · ◷

• expires on Jul 30, 2026, 12:35 PM UTC-08:00