[lockfile-stats] Lockfile Statistics Audit — 2026-08-01 (268 lockfiles, 37.3 MB)

[github-actions[bot]]

Executive summary

Metric	Value
Lockfiles analyzed	268 (0 skipped)
Total size	37.29 MB
Avg / min / max size	139.1 KB / 83.6 KB / 216.7 KB
Report date	2026-08-01
Parser	yaml.safe_load (PyYAML available: true)

File size distribution

Bucket	Count
100–250 KB	263
50–100 KB	5

Largest: smoke-copilot-aoai-entra.lock.yml (216.7 KB), smoke-copilot.lock.yml (215.5 KB), smoke-copilot-aoai-apikey.lock.yml (214.2 KB).
Smallest: example-permissions-warning.lock.yml (83.6 KB), codex-github-remote-mcp-test.lock.yml (84.2 KB), firewall.lock.yml (84.5 KB).

Trigger analysis

Trigger	Count	% of 268
workflow_dispatch	261	97.4%
schedule	185	69.0%
pull_request	33	12.3%
issues	4	1.5%
workflow_call	2	0.7%
issue_comment	2	0.7%
discussion / discussion_comment / push / workflow_run / deployment_status	1 each	0.4%

Top trigger combinations: schedule+workflow_dispatch (182, 67.9%), workflow_dispatch alone (46, 17.2%), pull_request+workflow_dispatch (28, 10.4%).

Schedule cron detail

185 scheduled workflows use 96 distinct cron expressions — only 11 crons repeat (each twice), the rest are unique per-minute offsets (e.g. 49 14 * * 1-5, 23 11 * * *). This is consistent with deliberately jittered scheduling to avoid a thundering herd at :00/:30.

Safe outputs analysis

Safe output	Count	% of 268
noop / missing-tool / missing-data / report-incomplete / create-report-incomplete-issue	263 each	98.1%
create-issue	124	46.3%
create-discussion	90	33.6%
add-comment	67	25.0%
create-pull-request	55	20.5%
push-repo-memory	37	13.8%
upload-asset / add-labels	25 each	9.3%
create-pull-request-review-comment / submit-pull-request-review	15 each	5.6%
update-issue	10	3.7%

Discussion categories used: audits (78), announcements (5), artifacts (2), dev (2), research (2), daily-news (1).

Structural characteristics

Metric	Total	Avg/workflow	Max (workflow)
Jobs	1,996	7.45	14 (release.lock.yml)
Steps	35,664	133.07	190 (smoke-copilot.lock.yml)
Scripts (run:)	15,699	58.6	—

Permission patterns

Read: actions (268, 100%), contents (268, 100%), pull-requests (230, 85.8%), issues (225, 84.0%), discussions (50, 18.7%), security-events (14, 5.2%).

Write: issues (266, 99.3%), contents (196, 73.1%), pull-requests (126, 47.0%), actions (98, 36.6%), discussions (95, 35.4%), copilot-requests (74, 27.6%), checks (13, 4.9%).

Timeout distribution (per job entry)

31–60 min: 268, 6–15 min: 28, ≤5 min: 2.

Tool & MCP patterns

Engine distribution: other/unclassified (118, 44.0%), copilot (68, 25.4%), claude (64, 23.9%), codex (15, 5.6%), antigravity/gemini/opencode (1 each).

MCP servers: github (103, 38.4%), serena (24, 9.0%), tavily (5), sentry (5), grafana (3), markitdown (3), ast-grep/arxiv/deepwiki/notion/microsoftdocs/datadog (2 each), semgrep/agentdb/context7/memory (1 each).

Interesting findings

1. Safe-output scaffolding is nearly universal, actual writes are not. noop/missing-tool/missing-data/report-incomplete appear in 263/268 lockfiles (98.1%), but only 124 (46.3%) ever call create-issue and 90 (33.6%) create-discussion — most workflows are wired to fail gracefully even when they rarely produce output.
2. Scheduling is deliberately jittered. Of 96 distinct cron expressions across 185 scheduled workflows, only 11 repeat — the rest use unique minute offsets, avoiding synchronized :00/:30 firing.
3. GitHub MCP dominates external tool integration, used by 38.4% of workflows — more than 4x the next most common server (serena, 9.0%).
4. Read/write permission floor is nearly universal: every workflow reads actions+contents, and 99.3% write issues — even though only ~46% of workflows create issues, implying broad grants likely support the shared report-incomplete/error-reporting scaffolding rather than being tightly scoped per-workflow.
5. workflow_dispatch is present almost everywhere (97.4%) — nearly every workflow supports manual re-runs regardless of its primary trigger.

Historical trends (vs. 2026-07-31)

Metric	2026-07-31	2026-08-01	Δ
Lockfiles	266	268	+2
Total bytes	36.55 MB	37.29 MB	+743 KB
Avg size	137.4 KB	139.1 KB	+1.7 KB
Jobs total	1,983	1,996	+13
Steps total	35,432	35,664	+232
Scripts total	15,601	15,699	+98
schedule triggers	184	185	+1
create-discussion	88	90	+2
claude engine	63	64	+1
github MCP	101	103	+2

The +232 steps / +98 scripts growth is almost entirely explained by the 2 new lockfiles (avg 133 steps/file) rather than existing workflows growing — per-workflow step average actually dipped slightly (133.20 → 133.07).

Recommendations

• Re-examine why issues: write is granted to 99.3% of workflows when only ~46% create/update issues — consider scoping down where the permission is unused outside shared error-reporting scaffolding.
• Continue the jittered-cron scheduling pattern for any newly added scheduled workflows to keep avoiding synchronized trigger spikes.
• Given GitHub MCP's dominant share (38.4%), prioritize any GitHub MCP server upgrades/hardening — it's the single highest-leverage shared dependency across the fleet.

Methodology: single-script compact JSON analysis (lockfile_stats_v1.py, cached in cache-memory/scripts/), parsing all .github/workflows/*.lock.yml via yaml.safe_load in one pass; no individual lockfile was opened outside that script.

Generated by 📊 Lockfile Statistics Analysis Agent · agent · 43.8 AIC · ⌖ 12.4 AIC · ⊞ 5.8K · ◷

• expires on Aug 2, 2026, 12:34 PM UTC-08:00