[lockfile-stats] 📊 Lockfile Statistics Analysis — 2026-07-11 (256 workflows, 29.2 MB)

[github-actions[bot]]

📊 Lockfile Statistics Analysis — 2026-07-11

Aggregate analysis of all compiled agentic workflow lockfiles (.github/workflows/*.lock.yml).

Overview: 256 lockfiles · 29.2 MB total · 0 malformed/skipped · YAML-parsed. Corpus essentially unchanged day-over-day (+3.8 KB), but up +23 workflows / +7.4 MB (~+37%) since 2026-05-20.

Metric	Value
Lockfiles	256
Total size	30,664,408 bytes (29.2 MB)
Avg / Median	117.0 KB / 115.4 KB
Min / Max	79.4 KB (example-permissions-warning) / 181.3 KB (smoke-copilot-aoai-entra)
Total jobs / steps / run-scripts	1,605 / 30,020 / 13,561

📦 File size distribution

Bucket	Count
100–250 KB	247
50–100 KB	9

Lockfiles are large and tightly clustered — every file exceeds 79 KB, reflecting the substantial boilerplate (safe-output plumbing, MCP setup, prompt embedding) the compiler emits per workflow. Largest are the multi-engine smoke-* test workflows (161–181 KB).

⏰ Trigger analysis

Trigger	Count
workflow_dispatch	248
schedule	175
pull_request	34
issues	4
push / issue_comment / workflow_call	2 each

Top combinations: schedule + workflow_dispatch (171), workflow_dispatch only (44), pull_request + workflow_dispatch (27). Nearly all workflows (248/256, 97%) expose a manual workflow_dispatch handle, and 68% are scheduled. Cron times are well-jittered across the clock (mostly off :00/:30 minutes), indicating good fleet-scheduling hygiene to avoid API stampedes.

📤 Safe outputs analysis

Five runtime/infrastructure outputs are present in essentially every safe-output-enabled workflow (251): noop, missing-data, missing-tool, report-incomplete, create-report-incomplete-issue. The user-configured output mix:

Safe output	Workflows
create-issue	116
create-discussion	87
add-comment	66
create-pull-request	54
push-repo-memory	36
add-labels	26
upload-asset	25
create-pull-request-review-comment	15
submit-pull-request-review	15
upload-artifact / create-check-run	13 each
update-issue / push-to-pull-request-branch	11 each

Long tail (≤5): close-issue, assign-to-agent, dispatch-workflow, slack/notion integrations, code-scanning-alert, project updates, etc.

Discussion categories: audits dominates (76), then announcements (5), artifacts (2), dev (2), daily-news (1), research (1).

🏗️ Structural characteristics

Metric	Min	Avg	Max
Jobs / workflow	4	6.27	12 (release)
Steps / workflow	79	117.3	163 (smoke-copilot)

Total run-scripts across the fleet: 13,561 (avg ~53/workflow). Job/step floors of 4/79 confirm a heavy fixed compiler scaffold on every workflow.

🔐 Permission patterns

Read is granted broadly and uniformly — actions and contents read on all 256; pull-requests (225) and issues (219) read on most.

Permission	write
issues	249
contents	131
pull-requests	123
discussions	92
copilot-requests	67
checks	13

issues: write is nearly universal (249/256) — driven by the safe-output incident-reporting path (create-report-incomplete-issue) baked into most workflows. Sensitive scopes stay rare: id-token (2), security-events (3), packages/statuses/attestations (1 each). Timeouts: all 256 jobs sit in the 31–60 min band, with 28 also having short 6–15 min jobs and 2 with ≤5 min.

🧰 Tool & MCP patterns

Engines: other (115), copilot (64), claude (60), codex (14), plus one each antigravity, gemini, opencode. (other reflects engine markers the text-scan couldn't attribute to a named engine.)

MCP servers: github leads by far (100), then serena (24), tavily (5), sentry (5), grafana (3), markitdown (3), and a diverse tail (brave-search, ast-grep, arxiv, deepwiki, notion, datadog, microsoftdocs, semgrep, agentdb, context7, memory).

🔎 Interesting findings

1. Steady-state fleet. Day-over-day the corpus is frozen (+3.8 KB, +1 step, +1 script) — no functional workflow changes on 2026-07-10→11, just trivial recompilation drift.
2. Rapid prior growth. Yet zooming out ~7 weeks, the fleet grew 233→256 workflows (+10%) and 22.4→29.2 MB (+30%) — recent expansion has plateaued.
3. Boilerplate dominates size. A 79 KB floor and 4-job/79-step minimum mean the smallest workflow is still huge; compiled scaffold, not user logic, drives lockfile weight.
4. issues:write is the default footprint. 97% carry it — almost entirely for automated failure-reporting, not core function. A worthwhile audit target for least-privilege.
5. GitHub-centric tooling. github MCP appears in ~39% of workflows; all other MCP servers combined appear in fewer. External integrations remain experimental/one-off.

📈 Historical trends

Metric	2026-05-20	2026-07-10	2026-07-11
Lockfiles	233	256	256
Total bytes	22.39 MB	30.66 MB	30.66 MB
Steps total	—	30,019	30,020
Scripts total	—	13,560	13,561

Engines, MCP servers, discussion categories, and trigger mix are all identical to 2026-07-10 — a fully stable day.

✅ Recommendations

1. Audit issues:write necessity — 249 workflows hold it; scope down any where incident-reporting to issues isn't actually used.
2. Investigate lockfile size floor — a 79 KB minimum suggests scaffold that could be trimmed or shared to cut compile/storage/parse cost across 256 files.
3. Attribute the other engine bucket — 115 workflows lack a clearly named engine in the text scan; refine detection or standardize the engine marker for cleaner telemetry.
4. Consolidate one-off MCP integrations — many servers appear once; document/support them or prune to reduce config surface.

---

Methodology: single-script compact JSON analysis. One cached Python analyzer (lockfile_stats_v1.py) parsed all 256 lockfiles with yaml.safe_load (with regex fallback for permissions/categories/safe-outputs) into a ≤50 KB summary; the report is derived solely from that JSON plus 51 days of cached historical snapshots. 0 files skipped.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by 📊 Lockfile Statistics Analysis Agent · 54.6 AIC · ⌖ 12.2 AIC · ⊞ 5.3K · ◷

• expires on Jul 12, 2026, 12:33 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Lockfile Statistics Analysis Agent.

A newer discussion is available at Discussion #45136.