[lockfile-stats] Lockfile Statistics: 365 workflows, 70.2 MB (2026-11-10)

[github-actions[bot]]

Overview

Analyzed 365 lockfiles on 2026-11-10: 0 skipped, 0 unresolved engines, 0 unresolved permissions. Total size is 70,249,874 bytes (about 70.2 MB), average 192,465 bytes.

Metric	Value
workflow_dispatch	354 (97.0%)
schedule	257 (70.4%)
Discussion-producing workflows	94 (25.8%), all 94 categories resolved
Change vs 2026-11-09	Lockfile count unchanged, total size +1,276,520 bytes (+1.85%)

Key findings

1. Discussion categories are fully resolved. 80 of 94 discussion-producing workflows (85.1%) target audits. One lockfile had no parseable safe-output config and was resolved through the text fallback.
2. Schedules cluster at midnight UTC. 62 of 257 scheduled workflows (24.1%) use 0 0 */2 * *, so they all start together every other day.
3. Agent jobs never write repository scopes. contents, issues, and pull-requests are never write in the agent job. Its only write scopes are copilot-requests (221) and id-token (4). Across all jobs, id-token is write in all 365 workflows, but the summary does not say which job grants it.
4. One outlier dominates structure. eslint-refiner has the most jobs (25), the most steps (355, about 2.2x the 161 average), and the most script steps (208).
5. Size is growing slowly. Total size is up 1.85% since 2026-11-09. The largest lockfile grew by 10,445 bytes.

Recommendations

1. Spread the 62 0 0 */2 * * schedules across the day to avoid a 00:00 UTC burst.
2. Add a per-job permission breakdown to the analyzer to confirm which job grants id-token: write in all 365 workflows.
3. Parse MCP tool allow-lists from the manifest. Tool-level usage is currently empty.
4. Review eslint-refiner (25 jobs, 355 steps) for consolidation.
5. Check the one lockfile that fell back to text parsing for its safe-output config.

File size distribution

Bucket (decimal KB)	Workflows
100-150 KB	33
150-200 KB	215
200 KB and over	117

• Min: 116,190 bytes (smoke-claude-copilot). p50: 191,484. p90: 216,950. Max: 389,478 (engine-conformance-dispatcher).
• Largest five: engine-conformance-dispatcher 389,478; daily-report-dispatcher 387,909; eslint-factory-dispatcher 382,247; smoke-work-queue-dispatcher 350,140; eslint-refiner 339,655.

Trigger analysis

Trigger	Workflows
workflow_dispatch	354
schedule	257
pull_request	48
workflow_call	5
issues	5
issue_comment	3
push	2
deployment_status, workflow_run, discussion, discussion_comment, repository_dispatch, pull_request_review_comment	1 each

Top combinations (18 distinct):

Combination	Workflows
schedule+workflow_dispatch	221
workflow_dispatch	83
pull_request+schedule+workflow_dispatch	33
pull_request+workflow_dispatch	10
Other (14 combinations)	18

Schedules: 257 scheduled workflows use 182 distinct cron strings. The most common is 0 0 */2 * * (62 workflows). The next most common is 7 5 * * * (3 workflows).

Safe outputs analysis

Safe output type	Workflows
create_issue	184
create_discussion	94
create_pull_request	81
add_comment	75
push_repo_memory	33
add_labels	32
upload_asset	26
create_pull_request_review_comment	17
submit_pull_request_review	17
update_issue	11
dispatch_workflow	10

Near-universal types: noop, report_incomplete, report_missing_data, and report_missing_tool (358 each). create_report_incomplete_issue appears in 356.

Discussion categories (94 workflows):

Category	Workflows
audits	80
announcements	5
artifacts	2
dev	2
research	2
general	1
daily-news	1
default	1

Detection status: 94 of 94 resolved, 0 unresolved, so there is no detection gap. Discussion-producing workflows exist, so the no-discussion-workflows case does not apply. One lockfile had no parseable GH_AW_SAFE_OUTPUTS_CONFIG and was resolved by text fallback.

Structural characteristics

Metric	Total	Average	Max (workflow)
Jobs	3,436	9.41	25 (eslint-refiner)
Steps	58,782	161.0	355 (eslint-refiner)
Script steps (run and github-script)	40,179	110.1	208 (eslint-refiner)

• Jobs per workflow: 6-11 jobs for 341 workflows (93.4%); 12 or more for 24.
• Steps per workflow: 150 or more for 266; 100-149 for 95; 50-99 for 4.
• Agent job timeout (minutes): 60 for 354; 10 for 3; 90 for 3; 120 for 2; 180 for 1; 20 for 1; 15 for 1.
• Across all jobs, the most common timeout is 5 minutes (734 jobs). One job sets 300 minutes.

Permission patterns (agent job, 365 workflows)

Scope	read	write	none
contents	365	0	0
issues	270	0	95
pull-requests	263	0	102
actions	150	0	215
discussions	52	0	313
security-events	15	0	350
vulnerability-alerts	2	0	363
copilot-requests	0	221	144
id-token	0	4	361
deployments, drives, models, packages	1 each	0	364 each

• Workflows whose agent job grants any write: 225 (61.6%).
• Union across all jobs: all 365 workflows grant at least one write. Per-scope write counts: id-token 365, issues 362, contents 301, pull-requests 167, actions 147, discussions 98, copilot-requests 221.
• The summary stores only read and write counts. The none column is derived as 365 minus read minus write.

Engine distribution

Engine (agent_id)	Workflows	Share
copilot	152	41.6%
codex	78	21.4%
claude	65	17.8%
pi	38	10.4%
13 others (aider, goose, agy, opencode, atomic, crush, cursor, deepseek-harness, factory, gemini, kiro, mini-swe-agent, pydantic-ai)	32	8.8%

• Unresolved engines: 0.
• Top engine versions: copilot 1.0.103 (153), codex 0.167.0 (78), claude 2.1.319 (66), pi 1.5.0 (38). The engine_versions map can list several engines per lockfile (copilot-sdk appears on 106), so its counts do not sum to the distribution above.
• Top agent models: copilot/auto (13), copilot/gpt-5 (13), copilot/claude-haiku-5.5 (9), copilot/gpt-5.3-codex (8).

Tool and MCP patterns

Servers from the manifest mcp_servers field. All 365 lockfiles have this field, so the comment-scraping fallback was not needed.

Server	Workflows
safeoutputs	365
github	205
agenticworkflows	45
work-queue	40
mcpscripts	36
serena	24
tavily, sentry	5 each
agy-native, grafana	3 each
ast-grep, datadog, deepwiki, microsoftdocs	2 each
kreuzberg, graft, agentdb	1 each

Tool-level frequencies are not available. The mcp_tools field is empty because no mcp allow-list comments were found.

Historical trends (vs 2026-11-09, latest of 6 prior summaries)

Metric	2026-11-09	2026-11-10	Delta
Lockfiles	365	365	0
Total bytes	68,973,354	70,249,874	+1,276,520
Average bytes	188,968	192,465	+3,497
Max bytes	379,033	389,478	+10,445
Jobs	3,437	3,436	-1
Steps	58,589	58,782	+193
Script steps	39,984	40,179	+195
Discussion workflows	94	94	0
workflow_dispatch	354	354	0
Scheduled	257	257	0

Engine counts match the prior day for every engine.

Methodology

Method: single-script compact JSON analysis. The run reused the cached analyzer lockfile_stats_v4.py and read only the compact summary. Limitations of that script version:

• Safe-output counts are per type. Hyphenated buckets and an other bucket are not computed.
• permissions_by_scope shows read and write counts only. The none column was derived as 365 minus read minus write.
• Permission unions are per scope across all jobs and are not attributed to a job.
• Engine counts come from agent_id in gh-aw-metadata. engine_versions can list several engines per lockfile.
• Sizes are raw file bytes. Buckets use decimal KB.
• Malformed lockfiles: 0 skipped.

References: §42893253939

Generated by 📊 Lockfile Statistics Analysis Agent · claude · routed: haiku55 xhigh · ~26 AIC · ⌖ ~2 AIC · ⊞ 5.7K · ◷

• expires on Nov 11, 2026, 12:26 PM UTC-08:00