[deep-research] Pattern library analysis: 25 archetypes, trigger risk data, and anti-patterns

[github-actions]

Scope

Analysis of committed patterns/manifest.json and patterns/archetypes/*.json only (no scanner run, no raw scan data touched). Read-only pass.

Corpus metadata

• Generated: 2026-08-31T09:42:11Z
• Source repos: 223 | Active workflows: 175 | Total workflows scanned: 671

Archetypes (25 total; 9 have empirical success rates, 16 are newer/aspirational archetypes with count: 0)

With data (sorted by success rate):

Archetype	Success rate	n	Best trigger	Safe outputs
daily-test-improver	1.00	3	permissions+reaction+schedule	pull-requests
documentation-updater	0.68	9	schedule+skip-if-match+permissions	pull-requests
custom (uncategorized)	0.50	356	schedule+roles+reaction	none defined
issue-triage	0.52	72	issues+roles+reaction	issues
code-improvement	0.46	73	schedule+reaction+permissions	pull-requests
pr-review	0.42	63	pull_request+roles+pull_request_target	pull-requests
status-report	0.38	36	schedule+skip-if-match+permissions	issues
repo-maintainer	0.33	8	reaction+slash_command+schedule	issues, pull-requests
content-moderation	0.00	3	issue_comment+issues+pull_request	issues, pull-requests

No empirical data yet (count=0), newer curated archetypes: accessibility-expert, agent-cost-tracker, ci-failure-triage, code-health-auditor, community-digest, contribution-guidelines-checker, issue-hierarchy-manager, linter-applier/miner/refiner/workflows, performance-nut, pr-iteration-loop, security-scanner, skill-pr-reviewer, user-simulator, dependency-monitor (listed separately with 0.50/n=48 in manifest but archetype file shows different figures — reconcile: archetype JSON reports success_rate 0.5, count 48).

Trigger combo risk (from manifest, 15 combos tracked)

• 13 of 15 tracked combos are "Recommended" (success_rate 0.90–1.00), including bots+check_suite+permissions+steps, reaction+schedule+stop-after, pull_request_target+roles+skip-bots, push+skip-bots, bots+permissions+steps+workflow_run (all 1.00, n=10 each).
• Lone reaction trigger: 0.99 success (n=90) — very reliable low-risk pattern.
• bots+roles+schedule+stale-check: 0.90 (n=20), still "Recommended" but the softest of the tracked set.
• No combos in the tracked list fall into medium/high risk — the manifest's curated trigger_combos list only retains high performers.

Anti-patterns (20 named, all with 0% success, each seen in exactly 1 repo)

Notable repeats across repos: daily-repo-status (3 repos), supply-chain-review (2 repos), issue-triage-named custom workflows, ci-doctor/ci-coach (CI-triage style, unscoped). Common thread: broad/unscoped mandates (e.g. "daily status", "supply chain review") with no narrowing constraints.

Configuration profiles (best/worst per archetype)

• code-improvement: best-observed config combo (schedule+skip-if-match → create-pull-request) had 0% success despite 23 runs across 4 workflows — suggests trigger choice alone doesn't guarantee success; workflow_run variant also 0%.
• custom: schedule+create-pull-request+noop → 95.2% (n=21, best profile in dataset); schedule+create-issue+noop+threat-detection → 83.9%; schedule+create-issue+noop → 80.0%.
• dependency-monitor: schedule+create-pull-request → 37.5% (n=56, best available); adding allowed-domains dropped to 31.0%.
• issue-triage: issues+roles → add-comment+add-labels+assign-to-agent only 12.2% (n=82) — worst profile of the trigger-scoped archetypes, despite issue-triage's overall 52% rate, implying assign-to-agent combos underperform simpler labeling.
• status-report: schedule+create-issue → 18.0% (n=61); adding mentions/allowed-github-references → 0.0% (n=40).

Research findings (from manifest)

• Bimodal distribution: 38% of workflows always succeed, 21% always fail, 41% mixed — averages are misleading.
• Explicit "DO NOT" constraints correlate with 61% higher health (p=0.009).
• workflow_run chaining: 13–16% success — avoid; prefer pre-steps or schedule.
• Pre-steps correlate with +13pp (internal) / +5pp (community) higher activity.
• Prompt size: active workflows run 35–48% larger prompts than inactive ones; 3–8KB is the general sweet spot, though code-improvement/daily-test-improver/repo-maintainer/pr-iteration-loop/linter-workflows/security-scanner recommend larger 5–20KB ranges for phase-based prompts.
• 32% of workflows are unmodified template clones, which underperform customized ones.

Recommended defaults (config_defaults)

• Timeout by trigger: issues/push/slash_command/workflow_run/discussion/pull_request = 15 min, schedule = 30 min (individual archetypes often override upward, e.g. pr-iteration-loop = 45 min, several = 10–20 min for narrow-scope archetypes).
• No default model pinned (model: null).

No repository content was scanned or modified; this is a summary of the committed pattern library only.

Generated by 🔬 Deep Research · copilot · auto · 26.4 AIC · ⌖ 5.52 AIC · ⊞ 6.1K · ◷