[lockfile-stats] Lockfile Statistics Audit — 258 workflows, 2026-07-07

[github-actions[bot]]

Executive summary

Snapshot of all compiled agentic workflow lockfiles as of 2026-07-07.

Metric	Value
Lockfiles analyzed	258 (0 malformed / skipped)
Total size	30,804,942 B (~29.4 MB)
Average size	119,399 B (~116.6 KB)
Median size	118,251 B (~115.5 KB)
Min / Max	80,327 B (test-workflow) / 184,569 B (smoke-copilot-aoai-entra)
Total jobs / steps / run-scripts	1,614 / 29,907 / 13,396

Lockfiles are large and uniform: 248 of 258 (96%) sit in the 100–250 KB band, reflecting a heavy, mostly-fixed compiled scaffold per workflow.

File size distribution

Bucket	Count
100–250 KB	248
50–100 KB	10

Largest & smallest lockfiles

Largest (bytes)

Workflow	Bytes
smoke-copilot-aoai-entra	184,569
smoke-copilot-aoai-apikey	184,160
smoke-copilot	184,048
smoke-claude	179,065
smoke-copilot-arm	170,094
smoke-codex	159,783
mcp-inspector	150,746
deep-report	149,088

Smallest (bytes): test-workflow (80,327), example-permissions-warning (81,264), firewall (82,203), codex-github-remote-mcp-test (82,354), hippo-embed (89,320).

The smoke-* family dominates the top end — engine smoke tests carry the widest tool/config surface.

Trigger analysis

Trigger	Workflows
workflow_dispatch	250
schedule	173
pull_request	34
issues	4
issue_comment	2
push	2
workflow_call	2
workflow_run / deployment_status / discussion / discussion_comment / pull_request_review_comment	1 each

Top trigger combinations: schedule+workflow_dispatch 169 · workflow_dispatch only 48 · pull_request+workflow_dispatch 27.

• 97% (250/258) expose manual workflow_dispatch.
• 67% (173/258) are scheduled; nearly all schedule-driven workflows also keep a manual dispatch escape hatch.
• Cron cadence is overwhelmingly daily with jittered minutes; a handful use */6h/*/4h, one weekly-Sunday (33 5 * * 0), one every-7-days (0 0 */7 * *). Minute jitter is well distributed — good for avoiding thundering-herd scheduling.

Safe outputs analysis

Discussion category targeting (reliable signal, parsed from config):

Category	Workflows
audits	76
announcements	5
artifacts	2
dev	2
daily-news	1
research	1

audits is by far the dominant discussion destination (~83% of category-targeting workflows).

Methodology caveat: per-type safe-output counts (create-issue / create-pull-request / add-comment / update-issue) cannot be extracted reliably from compiled lockfiles — every lockfile embeds generic handlers for all output types, so raw-text detection either inflates to all 258 or collapses. Differentiated text-scan estimates suggest ~87 workflows configure create-discussion, ~68 add-comment, ~15 create-pull-request-review-comment, and ~11 update-issue; treat these as approximate. Authoritative per-type counts should be read from source .md frontmatter, not lockfiles.

Structural characteristics

Metric	Min	Avg	Max
Jobs / workflow	4	6.26	12 (release)
Steps / workflow	78	115.92	161 (daily-news)

Totals: 1,614 jobs, 29,907 steps, 13,396 run-scripts across the fleet. The step floor of 78 confirms a heavy fixed scaffold (setup, engine install, MCP config, safe-output collection) present in every workflow.

Permission patterns

Scope	read (workflows)	write (workflows)
actions	258	5
contents	258	131
pull-requests	225	122
issues	221	249
discussions	50	92
security-events	14	3
checks	1	13

• contents: read and actions: read are universal (258/258) — every workflow reads repo + run metadata.
• issues: write is the most common write grant (249), ahead of contents: write (131) — the fleet skews toward commenting/triage over code mutation.
• discussions: write (92) exceeds discussions: read (50), consistent with the audit/report publishing pattern.

Tool & MCP patterns

MCP server	Total tool references
github	5,520
playwright	126
sentry	96
grafana	28
ruflo	16
arxiv	6
deepwiki	6

The GitHub MCP server is ~97% of all MCP tool surface. Read-oriented GitHub tools (get_*, list_*, issue_read, code-scanning/dependabot/secret-scanning readers) each appear in ~120 workflows — a large, uniform read toolbelt is standard.

Engine distribution:

Engine	Workflows
copilot	159
claude	60
pi	21
codex	14
antigravity / crush / gemini / opencode	1 each

Interesting findings

1. Fixed-cost scaffold dominates size. A 78-step floor and 96% of files in the 100–250 KB band mean per-workflow logic is a thin layer over a large compiled base — small .md changes still regenerate ~116 KB lockfiles.
2. The fleet is a reader, not a writer. Universal contents: read + actions: read, with issues: write (249) far exceeding contents: write (131): most agents observe and comment rather than modify code.
3. audits is the center of gravity for output. 76 workflows publish to the audits discussion category — more than 10× any other category.
4. Smoke tests are the heaviest workflows. The six largest lockfiles are all smoke-* engine tests (170–185 KB), carrying the broadest tool/config matrix.
5. Scheduling hygiene is good. 173 scheduled workflows use jittered minute offsets (few collisions) and 169 pair schedule with manual dispatch — resilient and debuggable.

Historical trends

Date	Lockfiles	Total bytes	Avg bytes	copilot / claude / pi / codex
2026-06-30	257	29,765,723	115,819	158 / 60 / 20 / 15
2026-07-06	258	30,749,425	119,183	160 / 59 / 21 / 14
2026-07-07	258	30,804,942	119,399	159 / 60 / 21 / 14

• Week-over-week (06-30 → 07-07): +1 lockfile, +1.04 MB total, avg size +3,580 B (~+3.1%) — growth is scaffold inflation, not new workflows.
• Day-over-day (07-06 → 07-07): count flat at 258, +55,517 B total, +216 B avg; engine mix shifted by one workflow (copilot −1, claude +1).

Recommendations

1. Attack the fixed scaffold, not the count. With avg size drifting +3% in a week on a flat workflow count, the compiled base is the lever — audit whether all 78+ baseline steps are needed per workflow, or can be shared/trimmed.
2. Right-size the GitHub MCP toolbelt. ~120 workflows import the full read tool surface; workflows that only need issue_read/get_pull_request could import a narrower set to cut lockfile size and prompt surface.
3. Tighten issues: write grants. 249 workflows hold issue-write; confirm each genuinely writes issues/comments rather than inheriting the grant from a template default.
4. Add authoritative safe-output stats at the source. Emit per-type safe-output counts from .md frontmatter during compile so this audit can report them reliably instead of estimating from lockfiles.

Methodology note

Single-script compact JSON analysis: all 258 .github/workflows/*.lock.yml files were parsed once (PyYAML safe_load, with a raw-text regex fallback for permissions, discussion categories, and safe-output signals) into a compact (~5.5 KB) JSON summary; all figures above are derived from that summary and three cached historical snapshots. Per-type safe-output counts are approximate for the reason noted in the Safe outputs section; all other figures are exact. 0 malformed files were skipped.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by 📊 Lockfile Statistics Analysis Agent · 98.7 AIC · ⌖ 12.6 AIC · ⊞ 5.3K · ◷

• expires on Jul 8, 2026, 12:56 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Lockfile Statistics Analysis Agent.

A newer discussion is available at Discussion #44411.