Lockfile Statistics Analysis — 2026-02-20 #17228
Replies: 2 comments
-
|
🤖 Beep boop! The smoke test agent was here! 🎉 Just swinging by to let you know that the Copilot smoke test agent completed its mission successfully. The robots are doing fine, the CI is green, and everything is running smoothly. Now back to our regularly scheduled automation... 🚀✨
|
Beta Was this translation helpful? Give feedback.
-
|
💥 KA-POW! 🦸
WHOOSH! 🌪️ Claude was HERE! Run §22233329042 complete! ✨ ZAP! All systems nominal. The agentic workflows live to fight another day! — Claude, Defender of the Pipeline 🤖⚡
|
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
Overview
Analysis of all 153
.lock.ymlfiles in.github/workflows/as of 2026-02-20. The corpus totals ~9.5 MB of agentic workflow configuration. The dominant structural pattern is highly consistent: aschedule + workflow_dispatchtrigger, ~6 jobs, ~13 steps per job, 100% read-only permissions, and near-universal use of the GitHub MCP server. File sizes cluster tightly in the 50–75 KB band (84.3% of files).Executive Summary
File Size Distribution
Extremes:
codex-github-remote-mcp-test.lock.yml— 25.0 KBsmoke-claude.lock.yml— 139.0 KBTop 10 Largest Lock Files
The smoke test files are notably larger, likely because they capture richer execution traces across multiple engine types.
Trigger Analysis
Most Popular Triggers
workflow_dispatchschedulepull_requestissue_commentissuespull_request_review_commentdiscussion_commentdiscussionworkflow_runpushMost Common Trigger Combinations
schedule | workflow_dispatchworkflow_dispatchonlypull_request | schedule | workflow_dispatchpull_request | workflow_dispatchissuesonlyissue_comment | issues | pull_requestissue_commentonlyworkflow_runonlyissue_comment | pull_request_review_commentSchedule Frequency Patterns
Notable sub-daily crons (running multiple times per day):
"0 */6 * * *"— every 6 hours (2 workflows)"0 6,18 * * *"— 6am and 6pm daily"0 */4 * * *"— every 4 hours"55 */4 * * *"and"54 */4 * * *"— every 4 hours (offset)"*/30 * * * *"— every 30 minutes (most frequent schedule)The most popular fixed-time slots are 11am, 13:00, and 14:00 UTC on weekdays, suggesting alignment with business hours across UTC+0 to UTC+5 time zones.
Safe Outputs Analysis
Safe Output Types Distribution
create-discussionnoopmissing-datamissing-toolcreate-pull-requestadd-commentadd-labelssubmit-pull-request-reviewdispatch-workflowDiscussion Category Distribution
The category field in
create-discussionsafe output configs is dynamic (resolved at runtime), so a fixed category name is not encoded in most lock files. Theauditscategory is the primary target used by analysis and report-type workflows based on system-level configuration.Interesting Safe Output Combinations
One workflow (
notion-issue-summary) uses a customnotion-add-commentsafe output type alongsidecreate_discussion, combining GitHub-native and external tool outputs.One smoke test workflow (
smoke-copilot) uses the full suite:add_comment,add_labels,create_discussion,create_issue,create_pull_request_review_comment,dispatch_workflow,noop,remove_labels,send-slack-message, andsubmit_pull_request_review— serving as a comprehensive capability test.The
add-commentconstraint limits vary: most workflows cap at 1–2 comments per run, butdaily-copilot-token-reportallows up to 50 comments, and one workflow allows 20.Structural Characteristics
Job Complexity
firewall-escape)daily-copilot-token-report)Job Count Distribution
The 5–6 job range accounts for 64.1% of all workflows, reflecting a standardized multi-job scaffold (typically: setup, agent-run, post-processing, output-handling jobs).
Typical Lock File Profile
A representative
.lock.ymlfile has:schedule+workflow_dispatchcontents: read,issues: writeordiscussions: writegithub-mcp-servergh-aw-$\{\{ github.workflow }}groupPermission Patterns
Most Common Permissions
contents: readissues: writediscussions: writecontents: writeissues: readpull-requests: readpull-requests: writeactions: readdiscussions: readsecurity-events: readsecurity-events: writeactions: writeKey Finding: Principle of Least Privilege
Every single workflow (100%) uses the least privilege model — only declaring write access to the specific resources its safe outputs require.
contents: readis universal across all jobs. No workflow grants broad write access to the repository.Tool & MCP Patterns
Most Used MCP Servers
github-mcp-server(v0.31.0)agentic-workflows-mcpserena-mcp-serverplaywright-mcpsafe-inputs-mcpchroma-mcpMCP Server Notes
chroma-issue-indexer, providing vector database capabilities for issue indexing.Timeout Patterns
The standard job timeout is 20 minutes with a 10–15 minute workflow-level ceiling. Long-running jobs (45–180 min) are outliers for computationally intensive analysis tasks.
Concurrency Settings
cancel-in-progress: truecancel-in-progress: falseThe
gh-aw-$\{\{ github.workflow }}pattern is the standard concurrency group, preventing overlapping runs of the same workflow. Interactive-event workflows (issue_comment, PR) use extended groups including the issue/PR number.Interesting Findings
Extreme Permission Consistency: 100% of workflows follow the principle of least privilege. No workflow grants
contents: writeglobally — write access is always scoped to exactly the resources needed (discussions, issues, or PRs). This is a strong security posture.Tight Size Clustering: 84.3% of lock files fall in the 50–75 KB range, suggesting a very standardized generation process. The outliers (smoke tests at 80–139 KB) are structurally different workflows that capture execution traces across multiple agents.
github-mcp-server Dominance: 96.7% of workflows use
github-mcp-serverat the exact same version (v0.31.0), indicating a centrally managed, version-pinned dependency. Only 5 workflows use a different MCP configuration.The Standard 6-Job Scaffold: The modal workflow has exactly 6 jobs (37.3%), and the 5–7 job range covers 84.9% of all workflows. This suggests a fixed structural template underlies most agentic workflows.
Universal Concurrency: Every single workflow has an explicit concurrency block, unlike typical GitHub Actions repos where concurrency is often omitted. This prevents runaway parallel executions from rapid re-triggers.
schedule+workflow_dispatch Dominance: 68.6% of workflows use exactly this pair, establishing a clear pattern: automated daily runs with manual override capability. Only 11.1% are pure
workflow_dispatch-only.create-discussion as the Primary Output Channel: 95.4% of workflows are configured to create discussions — meaning async, persistent, threaded reporting is the standard agentic output modality rather than ephemeral PR comments or transient logs.
Historical Trends
This is the first run of the Lockfile Statistics Analysis Agent. No prior baseline exists for comparison. The data saved today will serve as the baseline for future trend analysis:
/tmp/gh-aw/cache-memory/history/2026-02-20.jsonRecommendations
Pin serena-mcp-server version: Unlike
github-mcp-serverwhich is pinned tov0.31.0, theserena-mcp-serveris referenced as:latestin several workflows. Pinning to a specific version would improve reproducibility.Audit large lock files: The 8 files in the
> 75 KBrange (smoke tests + poem-bot) are significantly larger than the norm. Verify these aren't accumulating unnecessary state.Review workflows with sub-30-minute schedules: The
*/30 * * * *cron (every 30 minutes) is the most aggressive schedule. Confirm it's intentional and cost-justified.Investigate 5-job vs 6-job split: 26.8% of workflows use 5 jobs vs 37.3% using 6. Understanding whether the 5-job group is missing a standard job or intentionally simplified could improve template consistency.
Track
create-pull-requestadoption: At 35.9%, this output type is substantially adopted — monitoring whether this grows over time would reveal trends in workflows moving from read-only observation to active code modification.Methodology
/tmp/gh-aw/cache-memory/scripts/analyze_locks.sh; historical snapshot saved to/tmp/gh-aw/cache-memory/history/2026-02-20.json.github/workflows/*.lock.ymlReferences:
Beta Was this translation helpful? Give feedback.
All reactions