Lockfile Statistics Analysis — 2026-02-21

[github-actions[bot]]

This report provides a comprehensive statistical and structural analysis of all 157 .lock.yml agentic workflow files in .github/workflows/, collected and analyzed on 2026-02-21.

---

Executive Summary

Metric	Value
Total Lock Files	157
Total Size	~10,113 KB (9.9 MB)
Average File Size	64.4 KB
Smallest File	codex-github-remote-mcp-test (24.5 KB)
Largest File	smoke-claude (144.3 KB)
All Files Have Concurrency	✅ 157/157 (100%)
Analysis Date	2026-02-21

---

File Size Distribution

Size Range	Count	Percentage
< 10 KB	0	0.0%
10–50 KB	7	4.5%
50–100 KB	146	93.0%
> 100 KB	4	2.5%

The vast majority of lock files (93%) fall in the 50–100 KB range, reflecting a remarkably consistent compiled output size across workflows. The 4 files exceeding 100 KB are all smoke tests or data-heavy reporters.

Top 10 Largest Files

File	Size
smoke-claude	144.3 KB
smoke-copilot-arm	114.4 KB
smoke-copilot	114.3 KB
poem-bot	105.1 KB
smoke-project	90.6 KB
daily-performance-summary	88.0 KB
bot-detection	87.8 KB
smoke-codex	86.6 KB
cloclo	85.8 KB
mcp-inspector	85.3 KB

Top 10 Smallest Files

File	Size
codex-github-remote-mcp-test	24.5 KB
test-workflow	24.7 KB
example-permissions-warning	24.8 KB
firewall	25.2 KB
chroma-issue-indexer	27.2 KB
example-custom-error-patterns	27.4 KB
metrics-collector	34.6 KB
daily-malicious-code-scan	50.1 KB
test-dispatcher	51.4 KB
repo-tree-map	53.8 KB

---

Trigger Analysis

Most Popular Triggers

Trigger Type	Count	Percentage
workflow_dispatch	142	90.4%
schedule	116	73.9%
pull_request	19	12.1%
issue_comment	14	8.9%
issues	12	7.6%
pull_request_review_comment	6	3.8%
discussion_comment	5	3.2%
discussion	4	2.5%
workflow_run	2	1.3%
push	1	0.6%

Common Trigger Combinations

Combination	Count	Percentage
[schedule, workflow_dispatch]	106	67.5%
[workflow_dispatch] only	17	10.8%
[pull_request, schedule, workflow_dispatch]	7	4.5%
[pull_request, workflow_dispatch]	6	3.8%
Full event listener (discussion + issue + PR all types)	3	1.9%
[issues] only	3	1.9%
[issue_comment] only	2	1.3%
[workflow_run] only	2	1.3%

The dominant pattern is schedule + workflow_dispatch (67.5%), reflecting that most agentic workflows are designed to run automatically on a schedule while also supporting manual triggering.

Schedule Pattern Details

Schedule Types

Schedule Type	Count
Daily (every day)	64
Weekdays only (Mon–Fri)	23
Specific day of week	17
Periodic (every N hours)	12

Most Common Cron Patterns

Cron Expression	Count	Description
0 14 * * 1-5	4	Weekdays 14:00 UTC
0 13 * * 1-5	4	Weekdays 13:00 UTC
0 11 * * 1-5	4	Weekdays 11:00 UTC
0 9 * * 1-5	3	Weekdays 09:00 UTC
0 */6 * * *	2	Every 6 hours
0 15 * * 1-5	2	Weekdays 15:00 UTC
0 10 * * 1-5	2	Weekdays 10:00 UTC
0 16 * * 1-5	2	Weekdays 16:00 UTC

Schedule hours cluster between 09:00–17:00 UTC, corresponding to EU/US business hours overlap. This suggests workflows are optimized to deliver results when teams are active.

---

Engine (Agent) Distribution

Engine	Count	Percentage	Avg Size
Copilot	106	67.5%	62.9 KB
Claude	38	24.2%	68.6 KB
Codex	12	7.6%	64.1 KB
Gemini	1	0.6%	68.5 KB

Copilot is the dominant engine at 67.5%, with Claude as the second-most-used at 24.2%. Claude workflows tend to be slightly larger on average (68.6 KB vs 62.9 KB for Copilot), likely due to more complex tool configurations.

There are 10 dedicated smoke test workflows covering all major engines: smoke-claude, smoke-copilot, smoke-copilot-arm, smoke-codex, smoke-gemini, smoke-project, smoke-agent, smoke-multi-pr, smoke-temporary-id, and smoke-test-tools.

---

Safe Outputs Analysis

Safe Output Tools Distribution

Tool	Workflows	Percentage
noop	150	95.5%
missing_data	150	95.5%
missing_tool	150	95.5%
create_discussion	60	38.2%
create_issue	47	29.9%
add_comment	35	22.3%
create_pull_request	29	18.5%
upload_asset	22	14.0%
add_labels	14	8.9%
create_pull_request_review_comment	7	4.5%
update_issue	6	3.8%
push_to_pull_request_branch	6	3.8%
close_discussion	6	3.8%
submit_pull_request_review	6	3.8%
create_missing_tool_issue	4	2.5%
remove_labels	4	2.5%
link_sub_issue	3	1.9%
assign_to_agent	3	1.9%
dispatch_workflow	3	1.9%
hide_comment	2	1.3%
update_pull_request	2	1.3%
create_code_scanning_alert	2	1.3%
notion-add-comment	2	1.3%
send-slack-message	2	1.3%
create_project_status_update	2	1.3%
update_project	2	1.3%

Utility tools (noop, missing_data, missing_tool) appear in 95.5% of workflows, making them the de-facto standard output mechanism.

Top Feature Tool Combinations

Tool Combination	Count	Percentage
[create_discussion] only	26	16.6%
[create_issue] only	21	13.4%
[create_pull_request] only	16	10.2%
[create_discussion, upload_asset]	14	8.9%
[add_comment] only	6	3.8%
[add_comment, create_pull_request]	4	2.5%
[add_comment, add_labels, create_issue]	3	1.9%

Discussion Categories

Category	Count
audits	43
announcements	3
reports	3
artifacts	2
dev	2
research	2
agent-research	1
daily-news	1
security	1

The audits category is overwhelmingly dominant (43 of 60 discussion-creating workflows), confirming its role as the primary reporting channel for this agentic system.

Most Complex Safe Output Configurations

The poem-bot workflow has the most complex safe output config with 15 tools (excluding utility tools). Smoke tests also have high complexity as they test the full range of capabilities.

Top 5 Most Complex Safe Output Configs

Workflow	Tool Count	Notable Tools
poem-bot	15	create_agent_session, link_sub_issue, push_to_pull_request_branch, create_missing_tool_issue
smoke-claude	12	add_reviewer, resolve_pull_request_review_thread, push_to_pull_request_branch
smoke-copilot-arm	12	dispatch_workflow, send-slack-message, create_pull_request_review_comment
smoke-copilot	12	Same as smoke-copilot-arm
smoke-project	10	create_project_status_update, update_project

---

Structural Characteristics

Job Complexity

Metric	Value
Average Jobs per Workflow	6.0
Minimum Jobs	2
Maximum Jobs	9 (firewall-escape)
Most Common Job Count	6 (59 workflows)

Job Count Distribution

Jobs	Workflows
2	5
3	1
4	2
5	41
6	59
7	33
8	15
9	1

Universal Job Names

All 157 workflows share the same core job structure:

Job Name	Count	Percentage
activation	157	100.0%
agent	157	100.0%
conclusion	150	95.5%
safe_outputs	150	95.5%
detection	147	93.6%
update_cache_memory	67	42.7%
pre_activation	53	33.8%
upload_assets	22	14.0%
push_repo_memory	21	13.4%
unlock	2	1.3%
notion_add_comment	2	1.3%
send_slack_message	2	1.3%

The activation → agent → conclusion pipeline with detection and safe_outputs jobs forms the canonical agentic workflow skeleton.

Steps Analysis

Metric	Value
Minimum Steps	37
Maximum Steps	107 (daily-copilot-token-report)
Average Steps per Workflow	78.0

Top 10 Workflows by Step Count

Workflow	Steps
daily-copilot-token-report	107
audit-workflows	102
deep-report	102
copilot-pr-nlp-analysis	99
smoke-claude	99
smoke-copilot-arm	99
smoke-copilot	99
unbloat-docs	99
copilot-session-insights	98
daily-news	98

---

Permission Patterns

Most Common Permission Configurations

Permission Key	Count
contents:read	377
issues:write	143
issues:read	121
pull-requests:read	114
discussions:write	97
actions:read	59
pull-requests:write	52
contents:write	43
discussions:read	26
security-events:read	9
security-events:write	2
actions:write	1

Write vs Read-Only

Category	Count	Percentage
Workflows with write permissions	148	94.3%
Read-only workflows	9	5.7%

Common Job-Level Permission Sets

Permission Bundle	Count	Usage
{contents:read}	381	Base checkout/read (nearly every job)
{contents:read, discussions:write, issues:write}	104	Standard reporting
{contents:read, discussions:write, issues:write, pull-requests:write}	65	Full reporting + PR
{contents:read, issues:read, pull-requests:read}	59	Read-only analysis
{contents:read, issues:write}	55	Issue management
{contents:write}	45	Code writing
{actions:read, contents:read, issues:read, pull-requests:read}	38	CI monitoring

---

Timeout Configuration

Metric	Value
Total timeout-minutes occurrences	601 across 157 files
Average timeout	16.8 minutes
Minimum	5 minutes
Maximum	180 minutes

Timeout Distribution

Timeout	Occurrences	Notes
5 min	11	Short-lived setup/teardown steps
10 min	192	Most common — standard step timeout
15 min	175	Agent execution steps
20 min	173	Extended agent execution
30 min	32	Complex operations
45 min	12	Long-running analysis
60 min	4	Extended processing
90 min	1	smoke-claude
180 min	1	Maximum observed

The bi-modal distribution around 10 min (setup/utility steps) and 15–20 min (agent execution steps) is notable.

---

Concurrency Patterns

All 157 workflows (100%) use concurrency settings. The two dominant patterns are:

Pattern	Count	Percentage
gh-aw-$\{\{ github.workflow }}	124	79.0%
gh-aw-$\{\{ github.workflow }}-$\{\{ github.event.* }}	29	18.5%

The event-scoped concurrency (29 workflows) is used for event-driven workflows that should allow parallel execution on different issues/PRs, while the workflow-scoped pattern ensures only one instance runs at a time for scheduled workflows.

---

Infrastructure Patterns

Runner Distribution

Runner	Occurrences	Notes
ubuntu-slim	532	Optimized slim image (majority)
ubuntu-latest	407	Standard Ubuntu runner
ubuntu-24.04-arm	1	ARM testing (smoke-copilot-arm)

ubuntu-slim is preferred for most agent/processing jobs, while ubuntu-latest is used for standard GitHub Actions steps.

Memory & State Management

Pattern	Count	Percentage
update_cache_memory job	67	42.7%
push_repo_memory job	21	13.4%
References to /cache-memory/	68	43.3%
References to repo-memory	21	13.4%

External Integrations

Integration	Workflows
Notion	2
Slack	3

---

Interesting Findings

1. Perfect Concurrency Adoption: All 157 workflows (100%) use concurrency controls, preventing duplicate runs — a strong quality signal for production reliability.

2. Canonical Job Structure: The activation → agent → conclusion pattern with detection and safe_outputs jobs appears in 93–100% of all workflows, indicating a mature, standardized workflow framework with consistent lifecycle management.

3. Engine Diversity: While Copilot dominates (67.5%), the system supports 4 different AI engines (Copilot, Claude, Codex, Gemini). Claude workflows average slightly larger files (68.6 KB), possibly due to richer tool configurations.

4. Utility Tools Universal: noop, missing_data, and missing_tool appear in 95.5% of workflows. These "escape valves" let agents communicate failures or no-ops without side effects — a safety-first design principle.

5. audits Category Dominance: Of the 60 discussion-creating workflows, 43 (71.7%) target the audits category, making it the central reporting hub for the entire agentic system.

6. Remarkable File Size Consistency: 93% of all lock files are 50–100 KB, suggesting the compiled output from gh aw compile is highly normalized regardless of workflow complexity or engine type.

7. Business Hours Scheduling: Schedule triggers cluster heavily at 09:00–17:00 UTC with weekday preferences, indicating these workflows serve teams operating in European/US time zones with results ready during working hours.

8. Smoke Tests Cover Full Matrix: The 10 smoke test workflows provide systematic coverage of all supported engines and capabilities (claude, copilot, copilot-arm, codex, gemini, project management, multi-PR, temporary IDs, tool testing).

---

Recommendations

1. Expand Gemini Coverage: With only 1 Gemini workflow, consider expanding Gemini adoption or documenting why coverage remains limited.

2. Standardize Complex Safe Output Configs: Workflows with 10+ tools (like poem-bot) may benefit from documentation about which tool combinations are well-tested.

3. Review 9 Read-Only Workflows: The 5.7% of workflows with no write permissions — confirm these are intentionally read-only or if they should be updated.

4. Monitor the 4 workflows over 100KB: smoke-claude, smoke-copilot-arm, smoke-copilot, and poem-bot significantly exceed the norm. Regular review can prevent configuration bloat.

5. Cache Memory Adoption Gap: Only 42.7% of workflows use update_cache_memory. Workflows that collect repeated data (daily reports, metrics) could benefit from persisting state across runs.

---

Methodology

• Analysis Tool: Python 3 regex-based YAML parsing (no external dependencies)
• Lock Files Analyzed: 157 files in .github/workflows/*.lock.yml
• Analysis Date: 2026-02-21
• Cache Memory: Scripts saved to /tmp/gh-aw/cache-memory/scripts/full_analysis.py
• Historical Data: Stored at /tmp/gh-aw/cache-memory/history/2026-02-21.json
• Patterns Library: Saved to /tmp/gh-aw/cache-memory/patterns/

References:

• §22260376533

AI generated by Lockfile Statistics Analysis Agent

• expires on Feb 28, 2026, 4:49 PM UTC