[lockfile-stats] Lockfile Statistics Report — 2026-10-11

[github-actions[bot]]

Executive Summary

337 lockfiles analyzed on 2026-10-11 (0 skipped), up +3 from 334 the prior day. Total size 52.0 MB (avg 158.1 KB/file, min 87.6 KB, max 283.0 KB).

Metric	Value
Lockfiles	337
Total size	52.03 MB
Avg / min / max size	158.1 KB / 87.6 KB / 283.0 KB
Total jobs / steps / scripts	2,398 / 48,604 / 21,598
Engines in use	14 (0 unknown)
Any-write workflows	335 / 337 (99.4%)

Trigger Analysis

Trigger	Count	%
workflow_dispatch	328	97.3%
schedule	244	72.4%
pull_request	46	13.6%
workflow_call	5	1.5%
issues	5	1.5%
issue_comment	3	0.9%
push	2	0.6%
deployment_status / workflow_run / discussion / discussion_comment / pull_request_review_comment	1 each	0.3%

Top trigger combinations: schedule+workflow_dispatch (208, 61.7%), workflow_dispatch only (71, 21.1%), pull_request+schedule+workflow_dispatch (32, 9.5%, +3), pull_request+workflow_dispatch (9).

Dominant cron cadence: 0 0 */2 * * (every 2 hours) — 53 workflows (15.7% of all lockfiles, +3), far ahead of any other schedule.

Safe Outputs Analysis

Core infra safe-outputs (missing_data, missing_tool, noop, report_incomplete, create_report_incomplete_issue) appear in 330/337 lockfiles (97.9%).

Safe output type	Count
create_issue	176
create_discussion	92
add_comment	74
create_pull_request	65
push_repo_memory	33
add_labels	32
upload_asset	26
mentions	24

Full safe-output type breakdown (58 types)

create_pull_request_review_comment 16, submit_pull_request_review 16, upload_artifact 15, create_check_run 14, update_issue 10, push_to_pull_request_branch 10, max_bot_mentions 9, dispatch_workflow 9, ledger_append 7, close_issue 7, remove_labels 7, ledger_request_compaction 6, comment_memory 6, assign_to_agent 5, link_sub_issue 4, update_pull_request 4, close_pull_request 4, send-slack-message 4, create_code_scanning_alert 3, close_discussion 3, reply_to_pull_request_review_comment 3, set_issue_type 3, and 20+ types at count ≤2 (hide_comment, assign_to_user, create_agent_session, upload_code_coverage, jira_*, linear_create_issue, update_project, etc.)

Discussion categories (93 workflows configure create_discussion; category resolved for 92/93 — 1 unresolved: pr-sous-chef.lock.yml):

Category	Count
audits	79
announcements	5
artifacts	2
dev	2
research	2
general	1
daily-news	1

safe_outputs_config_missing: 1 lockfile (no GH_AW_SAFE_OUTPUTS_CONFIG found at all). Self-check passed: create_discussion_workflows (93) > 0 and detection gap (1/93 = 1.1%) is within the 10% threshold, so this is a genuine small gap, not a detection failure.

Structural Characteristics

	Total	Avg/workflow	Max
Jobs	2,398	7.1	23
Steps	48,604	144.2	325
Script steps	21,598	64.1	97

Permission Patterns (agent job)

The agent job itself is read-only on every tracked scope except the write-only copilot-requests scope — all writes are isolated to separate safe-output jobs.

Scope	Read	Write
contents	337 (100%)	0
issues	261 (77.4%)	0
pull-requests	255 (75.7%)	0
actions	140 (41.5%)	0
discussions	53 (15.7%)	0
security-events	14	0
copilot-requests	0	161 (47.8%)
id-token	0	2

Union write permissions (any job in the workflow, i.e. the safe-output jobs):

Scope	Workflows granting write
issues	335 (99.4%)
contents	228 (67.7%)
copilot-requests	161 (47.8%)
pull-requests	149 (44.2%)
actions	142 (42.1%)
discussions	96 (28.5%)
checks	14
security-events / id-token	3 each

permissions_unknown: 0 — every lockfile's job permissions resolved cleanly.

Engine Distribution

(from gh-aw-metadata agent_id; 0 unresolved)

Engine	Count	%
copilot	138	40.9%
codex	76	22.6%
claude	61	18.1%
pi	36	10.7%
aider / goose	4 each	1.2%
agy / opencode	3 each	0.9%
crush / cursor / deepseek-harness / gemini / kiro / pydantic-ai	2 each	0.6%

Tool & MCP Patterns

MCP server	Workflows
safeoutputs	313 (92.9%)
github	188 (55.8%)
work-queue	33
agenticworkflows	27
mcpscripts	25
serena	17
agy-native / tavily	3 each
sentry	2
kreuzberg / graft / ast-grep / grafana / deepwiki / microsoftdocs	1 each

7 lockfiles (2.1%) had no gh-aw-manifest and were parsed via the legacy # - mcp__... comment fallback.

Historical Trends (vs 2026-10-10)

Metric	2026-10-10	2026-10-11	Δ
Lockfiles	334	337	+3
Total size	51.56 MB	52.03 MB	+0.47 MB
workflow_dispatch triggers	325	328	+3
pull_request+schedule+workflow_dispatch combo	29	32	+3
0 0 */2 * * cron	50	53	+3
create_issue safe output	173	176	+3
Total jobs	2,380	2,398	+18
copilot engine	136	138	+2
pi engine	35	36	+1
copilot-requests write perm	158	161	+3
any-write workflows	332	335	+3

Interesting Findings

1. 3 new workflows landed in a single day, all sharing one fingerprint: pull_request+schedule+workflow_dispatch trigger combo (+3), create_issue safe output (+3), copilot-requests:write permission (+3), and the 10/45/60-min timeout trio (+3 each) — consistent with 3 new copilot-engine workflows from a common template.
2. Safe-output job isolation is enforced at scale: agent jobs show 0% write permissions on every scope except the write-only copilot-requests scope, while 99.4% of workflows (335/337) grant write access somewhere via a dedicated job.
3. Scheduling is dominated by one cadence: 0 0 */2 * * (every 2 hours) alone accounts for 15.7% of all lockfiles — far more than any other cron pattern.
4. Engine diversity beyond the big three: copilot/codex/claude cover 82% of workflows, but 11 other engines (pi, aider, goose, agy, opencode, crush, cursor, deepseek-harness, gemini, kiro, pydantic-ai) are in active production use.
5. Audits dominate discussion-based outputs: of 92 resolved create_discussion categories, 79 (85.9%) target audits — this very report included.

Recommendations

• Resolve the category gap for pr-sous-chef.lock.yml (1 of 93 create_discussion workflows) to reach 100% detection.
• Confirm the 1 lockfile with no safe-outputs config at all is intentional rather than a compiler regression.
• Migrate the 7 lockfiles still relying on legacy # - mcp__... comment scraping onto the gh-aw-manifest format.

Methodology

single-script compact JSON analysis

References: §38172016542

Generated by 📊 Lockfile Statistics Analysis Agent · claude · agent · 75.7 AIC · ⊞ 6.4K · ◷

• expires on Oct 12, 2026, 12:33 PM UTC-08:00

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-10-12T20:33:03.408Z.

Closed by Workflow