[lockfile-stats] Lockfile Statistics 2026-11-09

[github-actions[bot]]

Overview

Lockfile statistics for 365 compiled workflows in .github/workflows, generated 2026-11-09. All 365 lockfiles parsed with 0 skipped. Discussion category detection is complete: 94 of 94 create-discussion workflows resolved, so this is the configured and fully detected case, not a detection failure.

Metric	Value
Total size	68,973,354 bytes, +190,264 vs 2026-11-08
Average and median size	188,968 and 187,837 bytes
workflow_dispatch enabled	354 of 365 (97%)
Scheduled	257 of 365 (70%)
Create-discussion configured	94 of 365 (26%)
Engines unresolved / permissions unknown	0 / 0

Key findings

1. Cron clustering: 62 of 257 scheduled workflows (24%) use 0 0 */2 * *, so they all fire at the same minute. The day-of-month step also leaves a 1-day gap at month boundaries (31st then 1st), so it is not a true every-other-day cadence.
2. The four largest lockfiles are all dispatcher workflows, at 1.8 to 2.0 times the average size.
3. id-token: write appears in the union of job permissions for all 365 workflows, but only 4 agent jobs declare it. At least 361 workflows therefore grant it in a non-agent job. The analyzer does not record which job, so this is unverified.
4. Engine metadata mismatch: engine_versions maps list a copilot-sdk key in 106 lockfiles, but agent_id never resolves to it. Version-map counts (copilot 154, claude 66) exceed agent_id counts (copilot 152, claude 65), which suggests multi-key maps.
5. 7 lockfiles lack the standard noop and report_* safe-output keys (358 of 365 have them). One lockfile has no GH_AW_SAFE_OUTPUTS_CONFIG and was resolved by regex fallback to category default. Whether the regex missed a real category is unverified.

File size distribution

Bucket (decimal KB)	Workflows
under 50	0
50 to 100	0
100 to 150	34
150 to 200	236
200 and over	95

p90 is 214,714 bytes. Largest: engine-conformance-dispatcher 379,033; daily-report-dispatcher 377,464; eslint-factory-dispatcher 371,802; smoke-work-queue-dispatcher 340,470. Smallest: smoke-claude-copilot 115,752.

Trigger analysis

Trigger	Workflows
workflow_dispatch	354
schedule	257
pull_request	48
workflow_call	5
issues	5
issue_comment	3
push	2
deployment_status, workflow_run, discussion, discussion_comment, repository_dispatch, pull_request_review_comment	1 each

18 distinct combinations. Top three: schedule plus workflow_dispatch (221), workflow_dispatch alone (83), pull_request plus schedule plus workflow_dispatch (33). The 257 scheduled workflows use 182 distinct cron strings.

Safe outputs analysis

Workflows configuring each bucketed type: create-issue 184, create-pull-request 81, add-comment 75, create-discussion 94, create-pull-request-review-comment 17, update-issue 11.

Other types (workflows): push_repo_memory 33, add_labels 32, upload_asset 26, mentions 25, submit_pull_request_review 17, upload_artifact 16, create_check_run 14, push_to_pull_request_branch 12, dispatch_workflow 10, ledger_append 9, close_issue 7.

Infrastructure keys noop, report_incomplete, report_missing_data and report_missing_tool each appear in 358 lockfiles.

Discussion categories for the 94 configured workflows: audits 80, announcements 5, artifacts 2, dev 2, research 2, general 1, daily-news 1, default 1. Resolved 94, unresolved 0, regex-fallback 1.

Structural characteristics

Metric	Total	Average	Maximum
Jobs	3,437	9.42	25 (eslint-refiner)
Steps	58,589	160.5	355 (eslint-refiner)
Script steps (run or github-script)	39,984	109.5	208 (eslint-refiner)

Jobs per workflow: 6 to 14 jobs in 363 workflows, 16 and 25 in one each. 264 of 365 workflows (72%) have 150 or more steps.

Agent job timeout is 60 minutes in 354 workflows; the others are 10 (3), 90 (3), 120 (2), 180 (1), 20 (1) and 15 (1). Across all jobs, 5 minutes is most common (734 jobs), then 10 (401), 60 (354) and 15 (276).

Permission patterns

Agent job, declared scopes only. A scope a workflow does not declare is implicitly none and is not counted.

Scope	Read	Write
contents	365	0
issues	270	0
pull-requests	263	0
actions	149	0
discussions	52	0
security-events	15	0
copilot-requests	0	221
id-token	0	4

Other read-only scopes (1 to 2 workflows each): deployments, drives, models, packages, vulnerability-alerts. Agent jobs with any write scope: 225.

Union over all jobs: contents write 301, issues write 362, pull-requests write 167, discussions write 98, actions write 148, id-token write 365, checks write 14. All 365 workflows have at least one write grant somewhere.

Engine distribution

Engine (agent_id)	Workflows
copilot	152
codex	78
claude	65
pi	38
aider, goose	4 each
agy, opencode	3 each
atomic, crush, cursor, deepseek-harness, factory, gemini, kiro, mini-swe-agent, pydantic-ai	2 each

Unresolved: 0. Identical to 2026-11-08. Top models: copilot/auto 13, copilot/gpt-5 13, copilot/claude-haiku-5.5 9.

Tool and MCP patterns

Server usage (workflows): safeoutputs 365, github 205, agenticworkflows 44, work-queue 40, mcpscripts 36, serena 24, tavily 5, sentry 5, agy-native 3, grafana 3, ast-grep 2, datadog 2, deepwiki 2, microsoftdocs 2, kreuzberg 1, graft 1, agentdb 1.

All 365 workflows used manifest data, so the legacy comment fallback was not needed. Tool-level frequencies are not available: no MCP tool comment lines were found, so the tool table is empty.

Historical trends (vs 2026-11-08)

Metric	2026-11-08	2026-11-09	Delta
Lockfiles	365	365	0
Total bytes	68,783,090	68,973,354	+190,264
Average bytes	188,447	188,968	+521
Max bytes	378,672	379,033	+361
Jobs	3,437	3,437	0
Steps	58,223	58,589	+366
Script steps	39,983	39,984	+1
create-discussion workflows	94	94	0
workflow_dispatch	354	354	0
Scheduled	257	257	0

Recommendations

1. Confirm which job holds the id-token: write grants outside the agent job in at least 361 workflows, and whether each is needed.
2. Stagger the 62 0 0 */2 * * schedules across distinct minute offsets or explicit day lists.
3. Inspect the 7 lockfiles without the standard safe-output keys and the 1 without GH_AW_SAFE_OUTPUTS_CONFIG.
4. Fix analyzer gaps: count explicit none per scope, record the job for each grant, parse MCP tool entries, and count engine_versions only for the resolved agent_id.

Methodology

single-script compact JSON analysis. The cached lockfile_stats_v4.py was reused as the workflow requires, and its summary was read once. Limitations: the cached script does not compute explicit none counts per scope, MCP tool frequencies, or the job attribution noted above, so those items are reported as not available rather than estimated.

References: §42691021220

Generated by 📊 Lockfile Statistics Analysis Agent · claude · routed: haiku55 xhigh · ~25 AIC · ⌖ ~2 AIC · ⊞ 5.7K · ◷

• expires on Nov 10, 2026, 12:26 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Lockfile Statistics Analysis Agent.

A newer discussion is available at Discussion #76603.