[lockfile-stats] Lockfile Statistics — 2026-07-01

[github-actions[bot]]

Aggregate analysis of all compiled agentic workflow lockfiles (.github/workflows/*.lock.yml) using a single-script compact JSON pipeline.

Executive summary

Metric	Value	Δ 1d	Δ 7d
Lockfiles	258	+1	+7
Total size	28.6 MB (30,000,461 B)	+229 KB	+501 KB
Avg size	113.6 KB	+461 B	−1.2 KB
Median size	112.3 KB	—	—
Total jobs	2,070	+7	+57
Total steps	29,463	+110	+803
Total scripts	13,349	+40	+320
Malformed / skipped	0	—	—

Steady week-over-week growth: ~1 new workflow/day, driven mostly by Copilot-engine additions.

File size distribution

Bucket	Count
50–100 KB	15
100–250 KB	243

Range 78.2 KB → 178.4 KB. Largest are smoke-test matrices (multiple engine variants inflate the generated YAML).

Top 5 largest / smallest

Largest: smoke-copilot-aoai-entra (178.4 KB), smoke-copilot-aoai-apikey (178.0 KB), smoke-copilot (177.9 KB), smoke-claude (174.0 KB), smoke-copilot-arm (164.7 KB).

Smallest: test-workflow (78.2 KB), example-permissions-warning (79.1 KB), firewall (80.0 KB), codex-github-remote-mcp-test (80.3 KB), hippo-embed (86.9 KB).

Trigger analysis

Trigger	Count
workflow_dispatch	250
schedule	173
pull_request	34
issues	4
issue_comment	2
push	2
workflow_run / discussion / discussion_comment / pr_review_comment	1 each

Most common combinations: schedule + workflow_dispatch (169), workflow_dispatch only (50), pull_request + workflow_dispatch (27). 173 workflows are scheduled; cron cadences are heavily jittered (distinct off-round minutes) and cluster on daily (* * *), weekday (1-5), and every-6-hour (*/6) patterns.

Safe outputs analysis

The current regex-based analyzer (running with yaml_available:false) did not resolve structured safe-outputs type buckets or discussion categories from the compiled lockfiles this run — these fields returned empty and are not reported as zero. Flagged as a parser gap below rather than a real absence.

Structural characteristics

Dimension	min	avg	max	max workflow
Jobs / wf	5	8.0	13	release
Steps / wf	77	114.2	155	smoke-copilot
Scripts / wf	—	~51.7	—	—

Uniform lower bound (≥5 jobs, ≥77 steps) reflects the shared compiled scaffold (setup, firewall, engine, safe-output collection) every workflow inherits.

Permission patterns

All 258 lockfiles expose a top-level permissions: {} scaffold; per-permission read/write resolution was not captured this run (same parser limitation as safe-outputs). Effective permissions are set at the job level in the compiled output.

Tool & MCP patterns

MCP server	Mentions
github	5,520
playwright	126
sentry	96
grafana	28
ruflo	16
arxiv	6
deepwiki	6

GitHub MCP dominates. The most-referenced GitHub tools (read-heavy: get_pull_request*, list_*, get_discussion*, actions_*) each appear in ~120 workflows, consistent with the read-only GitHub MCP posture.

Engine distribution: copilot 159, claude 60, pi 21, codex 14, then antigravity / crush / gemini / opencode (1 each).

Timeout distribution (minutes): 31–60 → 289, 16–30 → 253, 6–15 → 126, ≤5 → 16, >60 → 3 (counts are per timeout directive across jobs).

Interesting findings

1. Copilot is the growth engine — the only net-new engine over the last day (158→159); claude flat at 60. Copilot now powers 62% of workflows.
2. Smoke-test matrices are the size outliers — the 6 largest files are all engine-variant smoke tests, each 15–20% larger than the median purely from generated matrix expansion.
3. Near-universal manual escape hatch — 250/258 (97%) expose workflow_dispatch, and 169 pair it with schedule, standardizing "scheduled + manually re-runnable".
4. GitHub MCP saturation — 5,520 github mentions vs 126 for the next server (playwright); ~30 GitHub read tools are wired into ~120 workflows apiece.
5. Codex dipped — the only engine to lose a workflow over the day (15→14), while pi gained one (20→21).

Historical trends

Compared to 2026-06-30 (1d) and 2026-06-24 (7d): the corpus grew +7 workflows and +501 KB over the week while average size fell 1.2 KB — new workflows are slightly leaner than the existing mean. Job/step/script totals scaled proportionally (+57 / +803 / +320 over 7d).

Recommendations

• Fix the analyzer parser gap: restore structured resolution of safe-outputs types, discussion categories, and per-permission read/write levels (bump to lockfile_stats_v2.py), since three report sections are currently blank due to yaml_available:false.
• Watch smoke-test size: consider whether the engine-variant smoke matrices need to remain fully expanded in committed lockfiles, or could be parameterized to reduce the 175+ KB outliers.
• No malformed lockfiles — compilation health is clean (0 skips); keep it green.

---

Methodology note: single-script compact JSON analysis. All lockfiles parsed in one cached analyzer run (lockfile_stats_v1.py); the report is derived from the resulting ≤50 KB summary and history deltas only. Fields left blank reflect a known regex-parser limitation, not measured zeros.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by 📊 Lockfile Statistics Analysis Agent · 48.8 AIC · ⌖ 11.6 AIC · ⊞ 5.2K · ◷

• expires on Jul 2, 2026, 12:53 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Lockfile Statistics Analysis Agent.

A newer discussion is available at Discussion #43037.