[lockfile-stats] Lockfile Statistics Report - 2026-11-08

[github-actions[bot]]

Overview

Analyzed 365 lockfiles in .github/workflows/ (365 parsed, 0 skipped), totalling 68.78 MB (average 188.4 KB). Self-checks passed: discussion category detection is complete (94 of 94 resolved), and engine and permission resolution succeeded for every lockfile. One lockfile has no parseable safe-output config and was classified by the regex fallback.

Metric	Value
Workflows with workflow_dispatch	354 (97.0%)
Workflows with schedule	257 (70.4%)
Workflows configuring create_discussion	94 (25.8%)
Jobs / steps / script steps (total)	3,437 / 58,223 / 39,983
Agent jobs with 60-minute timeout	354 of 365
Engine resolved	365 of 365 (0 unknown)

Interesting findings

1. Midnight cron pile-up. 62 of 257 scheduled workflows use 0 0 */2 * *, so they all start at 00:00 UTC on odd days of the month.
2. OIDC write outside the agent job. All 365 workflows grant id-token: write in at least one job, but only 4 grant it in the agent job.
3. Dispatchers are the largest files. Four of the five largest lockfiles (340 to 379 KB) are *-dispatcher workflows. The most complex workflow is eslint-refiner (25 jobs, 354 steps).
4. Timeouts are nearly uniform. 354 agent jobs use 60 minutes. The outliers are three at 90 minutes, two at 120 and one at 180.
5. One-day change. Against 2026-11-07, the lockfile count rose by 4, total size by 0.97 MB, and mini-swe-agent (2 workflows) appears as a new engine.

Recommendations

1. Stagger the 62 0 0 */2 * * schedules, or use fuzzy scheduling, so they do not all start at 00:00 UTC.
2. Review the id-token: write grants in non-agent jobs and remove them where OIDC is not used.
3. Confirm the 120- and 180-minute agent timeouts are intentional.
4. Extend the analyzer to name the workflow without a safe-output config, add an other-type bucket, count none permissions, and report tool-level MCP usage.
5. Check why 106 lockfiles list a copilot-sdk key in engine_versions.

File size and structure

File size

Bucket	Workflows
100-150 KB	36
150-200 KB	237
200 KB and up	92

Minimum 115.4 KB (smoke-claude-copilot), median 187.4 KB, p90 214.3 KB, maximum 378.7 KB (engine-conformance-dispatcher). Largest five: engine-conformance-dispatcher 378.7 KB, daily-report-dispatcher 377.0 KB, eslint-factory-dispatcher 371.4 KB, smoke-work-queue-dispatcher 340.0 KB, eslint-refiner 338.7 KB.

Structure

• Jobs per workflow: average 9.42; most common is 10 (97 workflows); range 6 to 25.
• Steps per workflow: average 159.5; 262 workflows have 150 or more, 98 have 100 to 149, and 5 have 50 to 99.
• Script steps (run or github-script): 39,983 in total, average 109.5 per workflow.
• Maxima (all eslint-refiner): 25 jobs, 354 steps, 208 script steps.
• Job-level timeouts (all jobs): 5 min 734, 10 min 401, 60 min 354, 15 min 276, 45 min 89; one job each at 180 and 300 min.

Triggers and schedules

Trigger	Workflows
workflow_dispatch	354
schedule	257
pull_request	48
workflow_call / issues	5 each
issue_comment	3
push	2
deployment_status, workflow_run, discussion, discussion_comment, repository_dispatch, pull_request_review_comment	1 each

Top combinations: schedule plus workflow_dispatch 221; workflow_dispatch only 83; pull_request plus schedule plus workflow_dispatch 33; pull_request plus workflow_dispatch 10. There are 18 distinct combinations. The 257 scheduled workflows use 182 distinct cron strings: 62 share 0 0 */2 * *, 3 share 7 5 * * *, and every other expression appears at most twice.

Safe outputs

Type	Workflows
noop, report_incomplete, report_missing_data, report_missing_tool	358 each
create_report_incomplete_issue	356
create_issue	184
create_discussion	94
create_pull_request	81
add_comment	75
push_repo_memory	33
add_labels	32

Types are counted once per workflow using snake_case config keys. The summary caps the list at the top 40 types. The cached analyzer does not compute an other-type bucket.

Discussion categories

Detection state: complete. 94 workflows configure create_discussion, and all 94 resolved to a category: audits 80, announcements 5, artifacts 2, dev 2, research 2, general 1, daily-news 1, default 1. The default bucket may include the one fallback-parsed lockfile; the summary does not separate the two.

Permissions (agent job)

Scope	Read	Write
copilot-requests	0	221
contents	365	0
issues	270	0
pull-requests	263	0
actions	149	0
discussions	52	0
security-events	15	0
id-token	0	4
deployments, drives, models, packages, vulnerability-alerts	1, 1, 1, 1, 2	0

225 workflows (61.6%) grant at least one write scope in the agent job; 140 grant none. Scopes not listed are treated as none. Across all jobs, every workflow grants at least one write scope. Write counts across all jobs: id-token 365, issues 362, contents 301, pull-requests 167, actions 148, discussions 98, copilot-requests 221, checks 14, security-events 3, code-quality 2, attestations 1, drives 1, packages 1, statuses 1.

Engines

Engine	Workflows	Share
copilot	152	41.6%
codex	78	21.4%
claude	65	17.8%
pi	38	10.4%
13 others	32	8.8%

The 13 others are aider 4, goose 4, agy 3, opencode 3, and nine engines with 2 each. Versions: copilot 1.0.103 (153 lockfiles) and 1.0.98 (1), codex 0.166.0 (78), claude 2.1.317 (66), pi 1.5.0 (38). Top models: copilot/auto 13, copilot/gpt-5 13, copilot/claude-haiku-5.5 9.

Tools and MCP

Servers by workflow count (from the manifest; no legacy fallback was needed): safeoutputs 365, github 205, agenticworkflows 44, work-queue 40, mcpscripts 36, serena 24, tavily 5, sentry 5, agy-native 3, grafana 3, ast-grep 2, datadog 2, deepwiki 2, microsoftdocs 2, kreuzberg 1, graft 1, agentdb 1. Tool-level frequencies are empty because no lockfile contains mcp__ tool comment lines.

Historical trends (vs 2026-11-07)

Metric	2026-11-07	2026-11-08	Change
Lockfiles	361	365	+4
Total bytes	67,812,852	68,783,090	+970,238
Average bytes	187,847	188,447	+600
Max bytes	371,308	378,672	+7,364
Jobs	3,404	3,437	+33
Steps	57,630	58,223	+593
Script steps	39,568	39,983	+415
create_discussion workflows	94	94	0
workflow_dispatch	351	354	+3
schedule	259	257	-2
copilot engine	151	152	+1
claude engine	64	65	+1
mini-swe-agent engine	0	2	+2

Methodology

Single-script compact JSON analysis. The cached analyzer lockfile_stats_v4.py was reused unchanged for one run, producing an 11,026-byte summary with no sections dropped. Sizes use decimal KB. Counts are per workflow unless marked job-level. Permission counts list only scopes that are set; the rest are none.

References: §42518991386

Generated by 📊 Lockfile Statistics Analysis Agent · claude · routed: haiku55 xhigh · ~34 AIC · ⌖ ~2 AIC · ⊞ 5.7K · ◷

• expires on Nov 9, 2026, 12:26 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Lockfile Statistics Analysis Agent.

A newer discussion is available at Discussion #76304.