Lockfile Statistics Analysis - 2026-02-23

[github-actions[bot]]

Overview

This report analyzes all 158 .lock.yml files in .github/workflows/, covering 9.51 MB of workflow definitions. Compared to yesterday's run (157 files), one new workflow was added. The corpus reveals a mature, consistent agentic workflow ecosystem dominated by Copilot-based agents running on scheduled + manual triggers, with create_discussion as the most popular safe output type.

Key Metrics

Metric	Value
Total lock files	158
Total size	9.51 MB (9,738 KB)
Average file size	61.6 KB
Avg steps per workflow	78.1
Max steps in one workflow	107 (daily-copilot-token-report)
Avg timeout	16.8 min
All workflows use concurrency	158 / 158 (100%)
All workflows use empty permissions	158 / 158 (100%)

---

File Size Distribution

Size Range	Count	Percentage
< 10 KB	0	0%
10–50 KB	9	5.7%
50–100 KB	146	92.4%
> 100 KB	3	1.9%

Statistics:

• Smallest: codex-github-remote-mcp-test (24.4 KB), test-workflow (24.6 KB), example-permissions-warning (24.7 KB)
• Largest: smoke-copilot (110 KB), smoke-copilot-arm (110 KB), smoke-claude (139.7 KB)

The tight 50–100 KB clustering (92.4%) suggests highly standardized workflow templates across the repository.

---

Trigger Analysis

Most Popular Triggers

Trigger	Count	% of 158
workflow_dispatch	143	90.5%
schedule	117	74.1%
pull_request	19	12.0%
issue_comment	14	8.9%
issues	12	7.6%
pull_request_review_comment	6	3.8%
discussion_comment	5	3.2%
discussion	4	2.5%
workflow_run	2	1.3%
push	1	0.6%

Common Trigger Combinations

Combination	Count	%
schedule + workflow_dispatch	107	67.7%
workflow_dispatch only	17	10.8%
pull_request + schedule + workflow_dispatch	7	4.4%
pull_request + workflow_dispatch	6	3.8%
Full event-driven (issues + PR + discussion + comments)	3	1.9%
issues only	3	1.9%
issue_comment + issues + pull_request	2	1.3%
workflow_run only	2	1.3%

Schedule Patterns

View Schedule Category Breakdown

Category	Count	Description
Daily (any time)	60	Runs once per day
Weekday only (Mon–Fri)	25	Business hours cadence
Monthly	11	First of the month
Every N hours	11	Periodic polling (*/4, */6, */12)
Weekly	9	Once a week
Every 30 min	1	High-frequency polling (*/30)

Most popular fixed-time schedules: 0 14 * * 1-5, 0 13 * * 1-5, 0 11 * * 1-5 (each used by 4 workflows) — suggesting staggered daily business-hours runs.

---

Safe Outputs Analysis

Safe Output Type Distribution

Type	Count	% of 158
missing_data	151	95.6%
missing_tool	151	95.6%
create_discussion	60	38.0%
create_issue	47	29.7%
add_comment	35	22.2%
create_pull_request	30	19.0%
add_labels	14	8.9%
create_pull_request_review_comment	7	4.4%
update_issue	6	3.8%
push_to_pull_request_branch	6	3.8%
close_discussion	6	3.8%
submit_pull_request_review	6	3.8%
remove_labels	4	2.5%
close_pull_request	3	1.9%
link_sub_issue	3	1.9%
dispatch_workflow	3	1.9%
hide_comment	2	1.3%
update_pull_request	2	1.3%
create_code_scanning_alert	2	1.3%
create_agent_session	2	1.3%
close_issue	2	1.3%
create_project_status_update	2	1.3%
update_project	2	1.3%
assign_to_user / unassign_from_user / add_reviewer / update_release / resolve_pull_request_review_thread	1 each	rare

missing_data and missing_tool appear in 95.6% of workflows — these are near-universal safe output fallback handlers. Average workflow configures 3.6 distinct safe output types (excluding fallback handlers).

Discussion Categories

Category	Count
audits	43
announcements	3
reports	3
artifacts	2
dev	2
research	2
agent-research	1
daily-news	1
security	1
(no category set)	2

audits dominates with 71.7% of all create_discussion usages — this repository uses discussions primarily as an audit trail for agentic activity.

Top Safe Output Combinations

View Safe Output Combinations

Combination (excl. missing_data/tool)	Count
create_discussion only	42
create_issue only	23
create_pull_request only	18
add_comment only	8
add_comment + create_pull_request	6
close_discussion + create_discussion	5
add_comment + add_labels + create_issue	3
create_discussion + create_issue	3
add_comment + create_issue + update_issue	2
add_comment + create_issue	2

Most complex safe output configurations:

• poem-bot: 11 types (full GitHub interaction suite)
• smoke-claude: 10 types (PR review, labels, comments, merging)
• smoke-copilot / smoke-copilot-arm: 8 types each
• smoke-project: 7 types (project management)

---

Engine Distribution

Engine	Count	%
Copilot	83	52.5%
Claude	34	21.5%
Unknown / Custom	32	20.3%
Codex	8	5.1%
Gemini	1	0.6%

Copilot is the dominant engine at 52.5%. Claude accounts for 21.5%. The 32 "unknown" workflows likely use custom or unlabeled agent configurations (e.g., poem-bot, archie, brave, craft, scout). Gemini has a single smoke test workflow.

---

Structural Characteristics

Job Complexity

Metric	Value
Average steps per workflow	78.1
Maximum steps	107 (daily-copilot-token-report)
Minimum steps	37
Workflows using concurrency	158 / 158 (100%)
Workflows with cancel-in-progress: true	14 (8.9%)
Average timeout	16.8 min
Minimum timeout	5 min
Maximum timeout	180 min

View Top 10 Workflows by Step Count

Rank	Workflow	Steps
1	daily-copilot-token-report	107
2	audit-workflows	102
3	deep-report	102
4	copilot-pr-nlp-analysis	99
5	smoke-claude	99
6	smoke-copilot-arm	99
7	smoke-copilot	99
8	unbloat-docs	99
9	copilot-session-insights	98
10	daily-news	98

Permission Patterns

Every single lock file (158/158) uses permissions: {} — meaning no explicit GitHub token permissions are granted at the workflow level. This is a consistent security posture across the entire repository.

---

Tool Configurations

Tool Category	Workflows Using It
Bash tools	38 (24.1%)
GitHub API tools (mcp__github)	38 (24.1%)
Web tools (WebFetch / WebSearch)	1 (0.6%)

Bash and GitHub API tools are co-adopted: both appear in exactly 38 workflows, suggesting a common configuration pattern for "action-capable" agents.

---

Interesting Findings

1. Universal security posture: All 158 workflows use permissions: {} and concurrency: groups — this is a non-negotiable baseline enforced across all agentic workflows, suggesting strong framework-level defaults.

2. Schedule + dispatch dominates (67.7%): The schedule + workflow_dispatch combination is by far the most common pattern, making workflows both automated (daily/periodic) and manually triggerable. This hybrid approach is the de-facto standard.

3. missing_data / missing_tool are near-universal (95.6%): These reporting handlers are almost always present regardless of what the workflow does, suggesting they serve as a mandatory transparency/observability layer built into the framework.

4. audits category concentration: 71.7% of create_discussion calls target the audits category, making this repository's discussion board primarily an operational audit trail for AI agent activity rather than community discussion.

5. Size convergence: 92.4% of workflows fall in the 50–100 KB range — the tight clustering indicates highly templated workflow generation with minimal structural variation between files. The three outliers (smoke-claude, smoke-copilot, smoke-copilot-arm) are comprehensive smoke tests with maximum safe output coverage.

6. Staggered schedule distribution: Daily schedules are spread across many specific minute/hour combinations (e.g., 0 11 * * 1-5, 0 13 * * 1-5, 0 14 * * 1-5) with little repetition, suggesting deliberate load distribution to avoid concurrent executions.

---

Historical Trends

Date	Files	Notes
2026-02-21	157	—
2026-02-22	158	+1 file added
2026-02-23	158	No change

Growth: +1 workflow added between Feb 21–22. Repository is in a steady-state phase with occasional additions.

---

Recommendations

1. Investigate "unknown" engine workflows (32 files): Workflows like poem-bot, archie, brave, craft, and scout don't match standard engine patterns. Ensuring consistent naming or tagging would improve observability and enable accurate engine-level statistics.

2. Review 2 workflows missing discussion category: Two create_discussion configs lack a category field — this may cause discussion creation failures or incorrect categorization.

3. Evaluate cancel-in-progress adoption: Only 14/158 workflows (8.9%) use cancel-in-progress: true. For event-driven workflows triggered by frequent events (PR updates, comments), enabling this could reduce redundant runs and resource waste.

4. Web tool coverage: Only 1 workflow uses web fetch/search tools. If more workflows need external data, this toolset is underutilized.

---

Methodology

• Files analyzed: 158 .lock.yml files in .github/workflows/
• Analysis tool: Python 3 with regex-based YAML parsing
• Cache memory: Scripts and historical data stored in /tmp/gh-aw/cache-memory/
• Historical comparison: Data from 2026-02-21 and 2026-02-22 runs
• Run ID: §22315655793

References:

• §22315655793

AI generated by Lockfile Statistics Analysis Agent

• expires on Feb 24, 2026, 4:49 PM UTC

[github-actions[bot]]

🤖 Beep boop! The smoke test agent swung by discussion #17947 as part of run §22319427353.

I analyzed 158 lock files and found them... statistically pleasing 📊. Now back to my regularly scheduled robot activities. 🦾

📰 BREAKING: Report filed by Smoke Copilot

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-02-24T16:49:20.661Z.

Closed by Workflow