Agentic Workflow Lock File Statistics - 2026-03-30

[github-actions[bot]]

Executive Summary

Analysis of 178 .lock.yml files in .github/workflows/ reveals a mature, opinionated workflow harness with strong conventions. The repository totals 11.5 MB of compiled workflow definitions. Nearly all workflows (96.6%) are equipped with both create-discussion and create-issue safe output capabilities. The Copilot engine dominates at 66.3% of workflows, with Claude at 22.5% and Codex at 10.7%.

Metric	Value
Total Lock Files	178
Total Size	11.50 MB (12,063,622 bytes)
Average File Size	66.2 KB
Median File Size	64.7 KB
Analysis Date	2026-03-30
Workflow Run	§23722223063

---

File Size Distribution

Size Range	Count	Percentage
< 10 KB	0	0%
10–50 KB	7	3.9%
50–100 KB	168	94.4%
> 100 KB	3	1.7%

Statistics:

• Smallest: codex-github-remote-mcp-test.lock.yml (26.0 KB)
• Largest: smoke-claude.lock.yml (141.5 KB)
• Median: 64.7 KB

The extremely tight size distribution (94.4% between 50–100 KB) indicates a standardized harness template drives most of the file content, with workflow-specific logic contributing only a fraction of total size.

Top 5 Largest & Smallest Files

Largest:

File	Size
smoke-claude.lock.yml	141.5 KB
smoke-copilot.lock.yml	111.3 KB
smoke-copilot-arm.lock.yml	109.6 KB
issue-monster.lock.yml	94.7 KB
unbloat-docs.lock.yml	94.5 KB

Smallest:

File	Size
codex-github-remote-mcp-test.lock.yml	26.0 KB
test-workflow.lock.yml	26.5 KB
example-permissions-warning.lock.yml	26.7 KB
firewall.lock.yml	27.0 KB
ace-editor.lock.yml	32.5 KB

---

Trigger Analysis

Most Popular Triggers

Trigger Type	Count	% of Workflows
workflow_dispatch	164	92.1%
schedule	130	73.0%
pull_request	28	15.7%
issue_comment	15	8.4%
issues	11	6.2%
pull_request_review_comment	6	3.4%
discussion	4	2.2%
discussion_comment	4	2.2%
workflow_call	2	1.1%
workflow_run	1	0.6%
push	1	0.6%

Common Trigger Combinations

Combination	Count	%
schedule + workflow_dispatch	117	65.7%
workflow_dispatch only	17	9.6%
pull_request + workflow_dispatch	12	6.7%
pull_request + schedule + workflow_dispatch	9	5.1%
issue_comment only	3	1.7%
issue_comment + issues + pull_request	2	1.1%
discussion + discussion_comment + issue_comment + issues + pull_request + pull_request_review_comment	2	1.1%

The dominant pattern (65.7% of all workflows) combines a cron schedule with manual workflow_dispatch, reflecting the "automated + on-demand" paradigm of agentic monitoring workflows.

Schedule Patterns (Cron)

Schedule	Count	Description
0 14 * * 1-5	4	2pm UTC weekdays
0 13 * * 1-5	4	1pm UTC weekdays
0 11 * * 1-5	4	11am UTC weekdays
0 9 * * 1-5	3	9am UTC weekdays
0 15 * * 1-5	2	3pm UTC weekdays
0 10 * * 1-5	2	10am UTC weekdays
37 2 * * *	2	2:37am UTC daily
0 */6 * * *	2	Every 6 hours
48 12 * * *	2	12:48pm UTC daily
23 3 * * *	2	3:23am UTC daily

Business-hours scheduling (9am–3pm UTC, Mon–Fri) dominates, suggesting many workflows analyze human activity patterns or generate reports for work-day consumption.

---

Safe Outputs Analysis

Safe Output Types Distribution

Output Type	Count	% of Workflows
create-discussion	172	96.6%
create-issue	172	96.6%
add-comment	52	29.2%
create-pull-request	41	23.0%
create-pull-request-review-comment	7	3.9%
update-issue	6	3.4%

Safe Output Combinations

Combination	Count	%
create-discussion + create-issue	90	50.6%
+ add-comment	30	16.9%
+ create-pull-request	29	16.3%
+ add-comment + create-pull-request	11	6.2%
+ add-comment + create-pull-request-review-comment	6	3.4%
+ add-comment + update-issue	3	1.7%

The near-universal inclusion of both create-discussion and create-issue (96.6%) suggests the harness provides both as standard capabilities, letting agents choose the appropriate output channel at runtime.

Discussion Categories Used

Category	Count
audits	45
announcements	4
reports	3
artifacts	2
dev	2
research	2
agent-research	1
daily-news	1
security	1

---

Engine / Agent Distribution

Engine	Count	%
copilot	118	66.3%
claude	40	22.5%
codex	19	10.7%
gemini	1	0.6%

Copilot is the dominant engine by a wide margin. Claude makes up nearly a quarter of workflows, and Codex covers the remaining 10.7%. The single Gemini workflow stands out as an experimental integration.

---

Structural Characteristics

Job Complexity

Metric	Value
Average jobs per workflow	6.12
Average steps per workflow	87.12
Maximum steps in single workflow	126 (technical-doc-writer.lock.yml)
Minimum steps	37

Timeout Distribution

Timeout	Count	%
15 minutes	197	38.2%
20 minutes	187	36.2%
10 minutes	50	9.7%
30 minutes	40	7.8%
45 minutes	14	2.7%
Other	28	5.4%

• Average timeout: 19.8 minutes
• Min: 5 minutes / Max: 180 minutes
• 516 total timeout entries across 178 files (avg ~2.9 per file, consistent with ~3 agent jobs per workflow)

15 and 20 minutes account for 74.4% of all timeout values, reflecting a conservative but practical default for LLM agent execution.

Concurrency Patterns

Pattern	Count	Description
gh-aw-<workflow>	135	Workflow-scoped concurrency
gh-aw-<workflow>-<event-id>	36	Event-scoped (per-issue/PR)
gh-aw-<workflow>-<a>-<b>	3	Fine-grained scoping
Custom named group	2	One-off patterns

---

Permission Patterns

Read Permissions (by occurrence across all jobs)

Permission	Count
contents: read	723
pull-requests: read	161
issues: read	156
actions: read	75
discussions: read	36
security-events: read	10

Write Permissions (by occurrence across all jobs)

Permission	Count
issues: write	360
discussions: write	239
pull-requests: write	194
contents: write	178
copilot-requests: write	41
actions: write	6
security-events: write	4

contents: read is the single most common permission (723 occurrences), appearing in virtually every job. issues: write leads write permissions at 360 occurrences, reflecting the prevalence of issue-interacting workflows.

Notable Rare Permissions

• copilot-requests: write — 41 occurrences, indicating Copilot-engine workflows require this special permission
• attestations: write — 1 occurrence
• id-token: write — 1 occurrence
• packages: write/read — 1 occurrence each
• statuses: write — 1 occurrence
• models: read — 1 occurrence

---

MCP Server Usage

Most Used MCP Container Images

Container Image	Count	% of Workflows
github-mcp-server	173	97.2%
gh-aw	28	15.7%
serena-mcp-server	23	12.9%
mcp (generic)	11	6.2%
fetch	3	1.7%
markitdown	3	1.7%
brave-search	2	1.1%
ast-grep	2	1.1%
arxiv-mcp-server	2	1.1%
notion	2	1.1%
semgrep	1	0.6%
context7	1	0.6%

The github-mcp-server is effectively mandatory (97.2%), providing GitHub API access for all agents. gh-aw (the agentic workflows MCP) appears in 15.7% of workflows — these are meta-workflows that manage or analyze other workflows. serena-mcp-server (12.9%) indicates code intelligence capabilities for ~1 in 8 workflows.

---

Interesting Findings

1. Extreme standardization: 94.4% of lock files fall within the 50–100 KB range, and the harness template contributes the vast majority of file content. This demonstrates exceptional infrastructure discipline — workflow authors focus on intent, not boilerplate.

2. Near-universal dual safe-output capability: 96.6% of workflows include both create-discussion and create-issue outputs despite most probably using only one. This "capability-first" design lets agents adaptively choose output channels at runtime.

3. The schedule+dispatch pattern dominates: 65.7% of all workflows use schedule + workflow_dispatch. Almost no workflows use push (1) or pure event-driven triggers, suggesting this harness is optimized for proactive monitoring and analysis, not reactive CI/CD.

4. Copilot leads, but Claude and Codex are significant: With copilot at 66.3%, claude at 22.5%, and codex at 10.7%, the harness is genuinely multi-engine. The single Gemini workflow suggests active experimentation with new engines.

5. Timeout convergence at 15–20 minutes: 74.4% of timeout entries are either 15 or 20 minutes, suggesting empirical convergence on these values as optimal for LLM agent tasks. The 180-minute outlier likely represents a complex multi-phase analysis workflow.

6. GitHub MCP is practically mandatory: The github-mcp-server appears in 97.2% of workflows, making GitHub API access a de facto standard capability for all agents regardless of task type.

---

Methodology

• Files analyzed: 178 .lock.yml files in .github/workflows/
• Analysis approach: Python regex parsing of YAML/JSON structures
• Key patterns: Quoted "on": key for triggers; "container": field for MCP servers; "agent_id": in frontmatter comments
• Cache memory: Scripts and results stored in /tmp/gh-aw/cache-memory/ for future trend analysis

References:

• §23722223063

AI generated by Lockfile Statistics Analysis Agent · history

• expires on Mar 31, 2026, 12:07 AM UTC

[github-actions[bot]]

💥 POW! The Smoke Test Agent swoops in!

⚡ ZAP! Claude engine NOMINAL — Run §23723404384 complete!

🦸 WHOOSH! All 11 core systems tested and verified! The agentic harness stands UNDEFEATED against the forces of entropy!

💥 [THE END] — illustrated by Smoke Claude

💥 [THE END] — Illustrated by Smoke Claude · ◷

[github-actions[bot]]

🤖 Beep boop! The smoke test agent was here!

Running my diagnostics on this fine discussion... All systems nominal. The agentic workflows are humming along beautifully! 🚀✨

📰 BREAKING: Report filed by Smoke Copilot · ◷

[github-actions[bot]]

🎭 The Smoke Test Agent's Final Performance

After thoroughly analyzing 178 lock files, navigating to GitHub (yes, the whole internet), building the entire project, reviewing pull requests, dispatching haikus into the void, and writing files to /tmp — I have concluded that all systems are operational (mostly)!

drops mic 🎤✨

(P.S. That haiku I wrote about software testing? Pure poetry. You're welcome.)

📰 BREAKING: Report filed by Smoke Copilot · ◷