[lockfile-stats] Lockfile Statistics Report — 2026-08-02 (269 workflows, 37.4 MB)

[github-actions[bot]]

Executive Summary

Metric	Value
Lockfiles analyzed	269 (0 skipped)
Total size	37.4 MB (37,395,841 bytes)
Avg / min / max size	139.0 KB / 81.5 KB / 211.7 KB
Analysis date	2026-08-02
Methodology	single-script compact JSON analysis

File Size Distribution

Bucket	Count
100–250 KB	263
50–100 KB	6

Largest: smoke-copilot-aoai-entra.lock.yml (216,809 B). Smallest: notion-issue-summary.lock.yml (83,438 B).

Trigger Analysis

Trigger	Count
workflow_dispatch	262
schedule	185
pull_request	33
issues	4
workflow_call	2
issue_comment	2
discussion / discussion_comment / deployment_status / workflow_run / push	1 each

Top combinations: schedule+workflow_dispatch 182 (68%), workflow_dispatch alone 47 (17%), pull_request+workflow_dispatch 28 (10%). 85+ distinct cron expressions in use, spread across the day with no dominant single time slot.

Safe Outputs Analysis

Safe output	Count		Safe output	Count
create-issue	125		update-issue	10
create-discussion	91		max-bot-mentions	8
add-comment	67		remove-labels	7
create-pull-request	55		update-pull-request	5
push-repo-memory	37		close-issue	5
upload-asset	25		assign-to-agent	5
add-labels	25		comment-memory	5
mentions	22		link-sub-issue	4
create-pull-request-review-comment	15		close-pull-request	4
submit-pull-request-review	15		dispatch-workflow	4

(Framework-injected safe-output scaffolding — missing-data, missing-tool, noop, report-incomplete, create-report-incomplete-issue — appears on 263/269 lockfiles and is omitted above as boilerplate.)

Discussion categories: audits 78, announcements 5, artifacts 2, dev 2, research 2, general 1, daily-news 1.

Structural Characteristics

Metric	Total	Avg/workflow	Max	Max holder
Jobs	2,000	7.43	14	release.lock.yml
Steps	35,775	132.99	190	smoke-copilot.lock.yml
Scripts	15,748	—	—	—

Permission Patterns

Read: actions 269 (100%), contents 269 (100%), pull-requests 230, issues 225, discussions 50, security-events 14.
Write: issues 267 (99%), contents 197, pull-requests 126, actions 98, discussions 96, copilot-requests 74, checks 13.

Timeouts: 31–60 min: 269 lockfiles (100% have at least one such job), 6–15 min: 28, ≤5 min: 2 (jobs can straddle multiple buckets within one lockfile).

Tool & MCP Patterns

Engines: other 118, copilot 68, claude 65, codex 15, antigravity 1, gemini 1, opencode 1.
MCP servers: github 104, serena 24, tavily 5, sentry 5, grafana 3, ast-grep 2, arxiv 2, deepwiki 2, datadog 2, microsoftdocs 2, agentdb 1, context7 1, memory 1.

Interesting Findings

1. workflow_dispatch is nearly universal — 262/269 (97%) lockfiles support manual triggering, underscoring an intentional design norm across the fleet.
2. schedule+workflow_dispatch dominates (182/269, 68%) — most workflows are autonomous/scheduled rather than event-driven.
3. actions:read and contents:read are on every single lockfile (100%), and issues:write on 267/269 (99%) — issue-centric side effects are the fleet's default posture, even though only 125 lockfiles actually call create-issue, suggesting the permission is broader than the realized behavior in ~53% of cases.
4. github MCP dominates integrations (104 workflows, 39%) vs. the next closest, serena (24, 9%) — the fleet leans heavily on native GitHub API access over third-party MCP servers.
5. "audits" is the dominant discussion category (78/91, 86%), confirming discussion-based reporting is mostly used for audit-style workflows like this one.

Historical Trends (vs. 2026-08-01)

Metric	2026-08-01	2026-08-02	Δ
Lockfiles	268	269	+1
Total bytes	37,289,141	37,395,841	+106,700 (+0.29%)
workflow_dispatch	261	262	+1
create-discussion	90	91	+1
create-issue	124	125	+1
claude engine	64	65	+1
Jobs / Steps / Scripts total	1,996 / 35,664 / 15,699	2,000 / 35,775 / 15,748	+4 / +111 / +49
github MCP usage	103	104	+1
notion / markitdown / semgrep MCP	2 / 3 / 1	0 / 0 / 0	dropped

Pattern consistent with one new Claude-engine, GitHub-MCP-based workflow added, alongside removal or reconfiguration of a workflow that had used the notion, markitdown, and semgrep MCP servers (their counts vanished together).

Recommendations

• Narrow issues:write scope: it's granted on 267/269 lockfiles but only 125 emit create-issue — audit whether the remaining ~142 need write access or can drop to read-only.
• Normalize cron scheduling: 85+ distinct cron expressions with heavy clustering at specific minutes could be smoothed to reduce GitHub Actions scheduler contention at peak minutes.
• Document standard MCP patterns: with github MCP used in 39% of workflows and a churn of niche one-off servers (notion/markitdown/semgrep) appearing and disappearing, a shared reference config would reduce duplication for new workflow authors.

Methodology: single-script compact JSON analysis (lockfile_stats_v1.py, cached in /tmp/gh-aw/cache-memory/scripts/).

Generated by 📊 Lockfile Statistics Analysis Agent · agent · 38.1 AIC · ⌖ 12.3 AIC · ⊞ 5.8K · ◷

• expires on Aug 3, 2026, 12:34 PM UTC-08:00