[lockfile-stats] Lockfile Statistics Audit — 2026-07-14 (256 workflows, ~30 MB)

[github-actions[bot]]

Executive Summary

Analysis of 256 compiled .github/workflows/*.lock.yml files on 2026-07-14. All parsed cleanly with yaml.safe_load — 0 skipped, 0 malformed.

Metric	Value
Lockfiles	256
Total size	31,433,214 bytes (~29.98 MiB)
Average	122,786 bytes (~119.9 KiB)
Median	121,472 bytes
Min	81,406 bytes (example-permissions-warning)
Max	202,634 bytes (smoke-copilot)

The corpus is large and remarkably uniform: compiled scaffolding (avg 117.6 steps/workflow) dominates each file, so lockfile size clusters tightly around ~120 KB regardless of agent logic.

File Size Distribution

Bucket	Count
100–250 KB	247
50–100 KB	9
< 50 KB	0

Largest & smallest

Largest: smoke-copilot (203 KB), smoke-copilot-aoai-entra (190 KB), smoke-copilot-aoai-apikey (190 KB), smoke-claude (184 KB), smoke-copilot-arm (175 KB), smoke-codex (165 KB), mcp-inspector (157 KB), deep-report (154 KB).

Smallest: example-permissions-warning (81 KB), firewall (82 KB), codex-github-remote-mcp-test (83 KB), hippo-embed (90 KB), ace-editor (90 KB).

Trigger Analysis

Trigger	Workflows
workflow_dispatch	249 (97%)
schedule	175 (68%)
pull_request	34
issues	4
push / issue_comment / workflow_call	2 each

Top combinations: schedule+workflow_dispatch (171), workflow_dispatch only (44), pull_request+workflow_dispatch (28).

175 cron schedules are well jittered — minute offsets spread across the hour (e.g. 49 14, 23 11, 38 3) rather than clustering on :00, avoiding thundering-herd load. Cadence is mostly daily (* * *) with a weekday band (* * 1-5) and a few */6h high-frequency jobs.

Safe Outputs Analysis

Five tools appear in 251/256 workflows — the built-in safety scaffold (noop, missing-tool, missing-data, report-incomplete, create-report-incomplete-issue). Excluding that baseline, the user-facing outputs:

Safe output	Workflows
create-issue	117
create-discussion	87
add-comment	66
create-pull-request	53
push-repo-memory	36
add-labels	26
upload-asset	25
create-pull-request-review-comment	15
submit-pull-request-review	15
push-to-pull-request-branch	11
update-issue	10

Discussion categories: audits (76), announcements (5), artifacts (2), dev (2), daily-news (1), research (1).

Structural Characteristics

Metric	Total	Avg/wf	Max
Jobs	1,611	6.29	12 (release)
Steps	30,106	117.6	180 (smoke-copilot)
Run/script steps	13,604	53.1	—

Per-job timeouts: 256 jobs in 31–60 min band, 28 in 6–15 min, 2 at ≤5 min.

Permission Patterns

Scope	Read	Write
contents	256	130
issues	219	249
pull-requests	225	123
discussions	50	92
actions	256	4
copilot-requests	—	67
security-events	14	3

actions:read and contents:read are universal (256). issues:write (249) is nearly universal — consistent with the create-issue/incomplete-issue safety pattern.

Tool & MCP Patterns

MCP servers by workflow count: github (100), serena (24), tavily (5), sentry (5), grafana (3), markitdown (3), brave-search (2), ast-grep (2), arxiv (2), deepwiki (2), notion (2), datadog (2), plus single-use semgrep, agentdb, context7, memory.

Engine distribution (regex-derived, approximate): copilot ≈64, claude ≈60, codex ≈14, plus one each antigravity/crush/gemini/opencode; a large other/unclassified bucket (~114) reflects engine:-line matches inside nested config. The copilot-requests:write permission (67 workflows) is a cleaner proxy for Copilot-engine adoption.

Interesting Findings

1. Scheduled-autonomous is the dominant shape. 97% carry workflow_dispatch and 68% schedule; schedule+workflow_dispatch alone covers 171 workflows (67%). These are overwhelmingly cron-driven agents with a manual escape hatch, not event-reactive bots.
2. Universal safety scaffold. 251/256 workflows compile in the noop / missing-tool / report-incomplete guardrail set — a near-invariant convention that any audit can rely on.
3. Size is scaffolding, not logic. 247/256 files exceed 100 KB with a median of 121 KB and 117 steps each; the agent-specific portion is a small fraction of every lockfile. Roughly 30 MB of generated YAML is committed to the repo.
4. GitHub MCP is the backbone; serena (24) is a distant but clear second, signalling heavy code-navigation usage across the fleet.
5. Cron hygiene is good. Minute offsets are deliberately scattered, so 175 scheduled workflows won't stampede the Actions runners on the hour.

Historical Trends

Comparable v1 snapshots exist since 2026-07-10.

Date	Lockfiles	Total bytes	create-discussion
2026-07-10	256	30.66 MB	87
2026-07-13	257	31.49 MB	87
2026-07-14	256	31.43 MB	87

Day-over-day: −1 lockfile, −57 KB total — essentially flat.
Long-run (since 2026-05-20): 233 → 256 lockfiles (+9.9%) and 22.4 MB → 31.4 MB (+40%). Byte growth has far outpaced file count, confirming the scaffolding-per-file expansion noted in finding 3.

Recommendations

1. Revisit committed lockfile weight. ~30 MB of generated YAML (median 121 KB/file) grows faster than the workflow count. Consider whether all lockfiles must be committed, or whether shared scaffolding could be factored to shrink diffs.
2. Audit the baseline safe-output set. The 251-workflow noop/missing-*/report-incomplete bundle is valuable, but confirm every workflow genuinely needs the full set rather than inheriting it by default.
3. Keep the cron jitter discipline. Current minute-offset spread is healthy; preserve it as the scheduled fleet grows past 175.
4. Tighten write scopes where possible. issues:write (249) and contents:write (130) are broad; workflows whose only output is a discussion or comment may not need issue/contents write.

Methodology

Single-script compact JSON analysis: one cached Python analyzer (lockfile_stats_v1.py) parsed all 256 lockfiles with yaml.safe_load (yaml_available: true) in a single pass, emitting a ~7 KB summary JSON; all figures above derive from that summary. Engine attribution and a few safe-output/category signals use regex fallback and are labelled approximate where noted.

References: §29366173484

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by 📊 Lockfile Statistics Analysis Agent · 62.4 AIC · ⌖ 12.5 AIC · ⊞ 5.3K · ◷

• expires on Jul 15, 2026, 12:41 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Lockfile Statistics Analysis Agent.

A newer discussion is available at Discussion #45816.