[lockfile-stats] Lockfile Statistics — 2026-09-13 #60687

Executive summary: 299 compiled .lock.yml workflows, 46,367,016 bytes total (~44.2 MB), avg 155.1 KB, min 91.6 KB, max 248.1 KB. 0 malformed/skipped files.

File size distribution

Trigger analysis

Top trigger combinations: schedule+workflow_dispatch (209), workflow_dispatch only (38), pull_request+schedule+workflow_dispatch (29), pull_request+workflow_dispatch (9).

Cron frequencies: 0 0 */2 * * (every 2 days) is the single largest cluster at 42 workflows; the remaining ~30 distinct cron strings are mostly unique per-workflow minute/hour offsets — a jitter pattern to avoid runner stampedes.

Safe outputs analysis

Near-universal scaffolding: noop, missing_tool, missing_data, report_incomplete each appear in 293/299 workflows (98%). Beyond that: create_issue 146 (49%), create_discussion 92 (31%), add_comment 77 (26%), create_pull_request 64 (21%), push_repo_memory 36, add_labels 32, upload_asset 26, mentions 23, then a long tail down to single-use types (e.g. jira_create_issue, linear_create_issue, update_project).

Discussion categories (92 create_discussion workflows, all 92 resolved — 0 unresolved):

Structural characteristics

Permission patterns

Agent job (primary per-workflow scope, mirrors frontmatter permissions:):

Union across all jobs (a scope counts write if any job grants it): all 299 workflows grant at least one write scope. Notably issues is write in all 299 (100%) at the union level despite the agent job itself often being read/none — some other job (safe-outputs handler) carries that write grant. contents write 206 / read 93; pull-requests write 146 / read 116 / none 37; discussions write 96 / read 10 / none 193.

permissions_unknown: 0 (fully resolved for every lockfile).

Engine distribution

engine_unknown: 0 (resolved via gh-aw-metadata agent_id for every lockfile).

Tool & MCP patterns

MCP servers by workflow count: safeoutputs 299 (100%, always present), github 175 (59%), agenticworkflows 44, serena 25, mcpscripts 12, tavily 5, sentry 3, remainder (ast-grep, datadog, deepwiki, microsoftdocs, grafana, kreuzberg, mempalace, graft, agentdb, ruflo) 1–2 each. No fallback (comment-scraping) parsing was needed — 100% resolved via the gh-aw-manifest JSON.

Timeout distribution (minutes, across job step declarations): 10min ×318, 45min ×299, 60min ×292, then rare 90/5/120/180/15.

Historical trends (vs. 2026-09-12)

Engine, permission, MCP, safe-output-type, and discussion-category distributions were unchanged day-over-day except a minor model-string shift (copilot/gpt-5.3-codex 34→33). Overall: a quiet day of incremental workflow growth with no structural or engine-mix shifts.

Recommendations

• 100% of workflows carry issues: write at the union level, but only 146/299 (49%) actually use create_issue/update_issue/etc. Consider auditing whether the safe-outputs job's issues: write grant can be scoped down for workflows that never emit issue-related safe outputs.
• Spot-check a few of the 42 workflows sharing the 0 0 */2 * * cron to confirm minute/hour offsets are still deliberately staggered, since they share the same day-cadence.
• audits covers 86% of discussion-producing workflows; confirm this default isn't masking missing category configuration for workflows that intend a different category.
• Track the copilot/codex/claude engine mix over time — worth confirming whether copilot's 41% share reflects deliberate default guidance or organic workflow-author choice.

Methodology: single-script compact JSON analysis.

References:

• §34780456254

network:
  allowed:
    - defaults
    - "api.anthropic.com"

Generated by 📊 Lockfile Statistics Analysis Agent · claude · agent · 94.3 AIC · ⌖ 8.03 AIC · ⊞ 8.5K · ◷

• expires on Sep 14, 2026, 12:28 PM UTC-08:00