[lockfile-stats] Lockfile Statistics — 2026-08-16

[github-actions[bot]]

Analysis of all compiled workflow lockfiles (.github/workflows/*.lock.yml) in github/gh-aw. Methodology: single-script compact JSON analysis (PyYAML safe_load, one analyzer pass, no per-file inspection).

Overview: 285 lockfiles parsed, 0 skipped (malformed). Total size 40,054,725 bytes (~38.2 MB), avg 140,543 bytes/file.

File size distribution

Metric	Value
Count	285
Total	38.2 MB
Average	137.2 KB
Min	81.5 KB (codex-github-remote-mcp-test.lock.yml)
Max	218.3 KB (smoke-copilot-aoai-entra.lock.yml)

Trigger analysis

Top triggers: workflow_dispatch (278), schedule (194), pull_request (39), issues (4), issue_comment/workflow_call (2 each).

Most common trigger combinations:

Combination	Count
schedule + workflow_dispatch	191
workflow_dispatch only	48
pull_request + workflow_dispatch	34
pull_request only	2
workflow_call + workflow_dispatch	2

278/285 (97.5%) expose workflow_dispatch for manual runs. Cron schedules are well-spread — no single time-of-day dominates; the busiest slot (7 5 * * *) appears in only 3 workflows, suggesting deliberate stagger to avoid thundering-herd scheduling.

Safe outputs analysis

Safe output type	Occurrences
create-issue	414
create-discussion	276
add-comment	223
create-pull-request	177
create-pull-request-review-comment	51
update-issue	30

Discussion categories referenced: audits (79), announcements (5), artifacts/dev/research (2 each), general/daily-news (1 each). One counter bucket (6 hits) reflects a non-literal category field (object-valued, e.g. templated/expression-driven) rather than a plain string — expected artifact of regex-based category scanning, not a data error.

Structural characteristics

Metric	Max	Avg	Workflow (max)
Jobs/workflow	14	7.34	release.lock.yml
Steps/workflow	199	139.35	smoke-copilot.lock.yml
Run-scripts/workflow	85	61.5	smoke-copilot-aoai-entra.lock.yml

Timeout-minutes distribution: 45 (286 job entries), 10 (29), 5 (2) — the codebase has standardized almost entirely on a 45-minute job timeout.

Permission patterns

Read: contents (1250), actions (681), pull-requests (253), issues (241), discussions (50), security-events (14).
Write: issues (642), contents (393), pull-requests (320), copilot-requests (232), discussions (191), actions (109), checks (28).

Write permissions outnumber read permissions for issues (642 write vs 241 read) and pull-requests (320 write vs 253 read) — consistent with a fleet of workflows whose primary job is creating issues/PRs/comments (safe outputs) rather than just reading repo state.

Tool & MCP patterns

Engine distribution: claude (282 workflow references), codex (94). MCP server/tool usage counters returned low-signal matches (a version string v1.9.0 appearing 1,232 times, likely the pinned MCP/action version rather than a server name) — precise per-server/tool breakdowns need a schema-aware extractor rather than regex scanning of compiled YAML; flagged as a follow-up.

Interesting findings

1. Universal dispatch-ability: 97.5% of lockfiles support workflow_dispatch, making nearly every automation independently re-runnable/testable without waiting for its schedule.
2. create-issue is the most common safe output (414), ahead of create-discussion (276) and add-comment (223) — issue creation is the dominant automated write action across the fleet.
3. Timeout standardization: 286 of ~317 job-timeout declarations use exactly 45 minutes, indicating a shared convention/template rather than per-workflow tuning.
4. copilot-requests: write appears in 232 workflows — a notable permission footprint worth auditing for least-privilege scoping given it's the 4th most common write permission.
5. Codex adoption: 94 workflow references to the codex engine vs 282 for claude — roughly 1 codex-based workflow for every 3 claude-based ones.

Historical trends

No prior daily summary found in /tmp/gh-aw/cache-memory/history/ — this run establishes the first baseline (2026-08-16.json). Future runs will report deltas against it.

Recommendations

• Audit the 232 workflows granting copilot-requests: write for least-privilege necessity.
• Replace regex-based MCP server/tool extraction with a YAML-schema-aware pass in the next script version (lockfile_stats_v2.py) to get accurate per-server/tool usage counts.
• Consider consolidating the single non-standard category bucket (6 hits, object-valued category) if it reflects an unintended template artifact rather than a deliberate expression.

Methodology: single-script compact JSON analysis.

Generated by 📊 Lockfile Statistics Analysis Agent · agent · 32.2 AIC · ⌖ 4.91 AIC · ⊞ 6.1K · ◷

• expires on Aug 17, 2026, 12:20 PM UTC-08:00