audit-cicd

Files (1)

• SKILL.md

SKILL.md (first lines)

# CI/CD Audit Skill

**Degree of freedom: MIXED** — Steps 1–3 judgment `[HIGH freedom]`; Step 0
`gh` inventory and Step 4 deletes `[LOW freedom — run exactly]`.

Systematic audit of GitHub Actions workflows to cut the Actions bill (minutes +
storage) and speed up CI **without losing test coverage or deploy safety**.
Uses the `gh` CLI for live billing, run history, and storage data.

## This skill vs neighbors

| Skill | Owns |
|---|---|
| **audit-cicd** (this) | GitHub Actions CI/CD audit for cost, speed, and safety |
| `audit-gate-logic` | Read-only CI gate logic: silent bypass, ratchet gaming, duplicate gates |
| `housekeep-gates` | Consolidate accreted CI gates, ratchets, hooks into one aggregator check |
| `audit-infra-cost` | Read-only hosting, database, storage, egress, and serverless spend audit |

## How to reason

1. **Observe** — quote the trigger, `runs-on`, `concurrency`, or `gh` minute/storage number
2. **Interpret** — billed twice, doomed minutes, or a 10× runner on every push?
3. **Classify** — double-bill / no-concurrency / expensive-runner / doomed-job / storage / correct
4. **Severity** — by `$` × safety; never score a cut that drops coverage

## Worked example

> **Observe:** `build-mobile.yml` `runs-on: macos-15` on `push:` to every
> branch; no `if:` gate; private repo.
> **Interpret:** every push bills ~10× Ubuntu for an iOS job nobody requested.
> **Classify:** expensive-runner on ordinary push.
> **Severity:** Very high (~10×).
> **Finding:** `build-mobile.yml` | macos on push | dispatch/tag-only | ~10×

## Step 0: Inventory the account and pipelines  [LOW freedom — run exactly]

Measure before optimizing. Only **private** repos consume the paid minute
allowance; public repos get free minutes — don't spend effort there.

```bash
# Which repos actually cost money (private, active, recent pushes)?
gh repo list <owner> --limit 200 --json name,visibility,isArchived,pushedAt \
  --jq 'sort_by(.pushedAt)|reverse|.[]|select(.visibility=="PRIVATE" and .isArchived==false)|"\(.name)\t\(.pushedAt[0:10])"'

# Per repo: active workflows, run volume (last 14d), and runner types
gh api "repos/<owner>/<repo>/actions/workflows" --jq '.workflows[]|select(.state=="active")|.name'
gh run list --repo <owner>/<repo> --created ">=YYYY-MM-DD" --limit 200 --json databaseId --jq 'length'

# Storage (the other half of the bill)
gh api "repos/<owner>/<repo>/actions/artifacts" --paginate --jq '[.artifacts[]|select(.expired==false)|.size_in_bytes]|add'
gh api "repos/<owner>/<repo>/actions/cache/usage" --jq '.active_caches_size_in_bytes'
```

Rank repos by `runs × runner-multiplier`. A `macos-*` job counts ~10x a
`ubuntu` job; `*-large`/bigger runners cost more than standard.

## Step 1: Anti-pattern scan (per workflow)  [HIGH freedom]

For each `.github/workflows/*.yml`, check for the recurring cost drivers:

- [ ] **Double-billing triggers** — the *same jobs* run on both `push: [main]`
      and `pull_request` for main (every merge bills twice). PR gates
      verification; a separate `deploy.yml` handles main. If both are needed,
      guard per-job with `if: github.event_name == '...'`.
- [ ] **Missing `concurrency`** — no `cancel-in-progress`, so rapid pushes/PR
      syncs stack full runs instead of superseding.
- [ ] **Expensive runners on ordinary pushes** — `macos-*` / `*-large` firing
      on every push instead of `workflow_dispatch` or version tags only.
- [ ] **No path filters** — docs/config-only changes run the full heavy suite
      (add `paths:` / `paths-ignore:`).
- [ ] **Doomed jobs** — a costly job (visual/e2e/Lighthouse) runs in parallel
      with a cheap gate and keeps burning minutes after the gate fails
      (gate it with `needs: [...]`).
- [ ] **Long/default artifact retention** — `upload-artifact` without
      `retention-days` keeps outputs 90 days; heavy reports uploaded on
      success (`if: always()`) instead of `if: failure()`.
- [ ] **Self-uploading SARIF pile-ups** — e.g. gitleaks-action uploads a tiny
      SARIF artifact every run for 90 days.
- [ ] **Over-frequent crons** — daily `schedule:` where weekly suffices.
- [ ] **Redundant rebuilds** — two jobs each run the same build instead of
      building once and sharing via artifact (only when their build env is
      identical — see Safety).

## Step 2: Cost levers (highest impact first)  [HIGH freedom]

| Lever | Fix | Impact |
|-------|-----|--------|
| macOS/large on push | Gate to `workflow_dispatch` / tags | Very high (~10x) |
| Doomed heavy jobs | `needs: [cheap-gate]` so they skip on failure | High |
| Double-billing triggers | Drop the redundant trigger (keep the gate) | High |
| No concurrency | Add `cancel-in-progress` | Medium |
| No path filters | `paths:` / `paths-ignore:` | Medium |
| Daily crons | Move to weekly | Medium |
| Artifact retention | `retention-days: 1–7` + `if: failure()` | Storage |
| Repeated installs | Cache deps / Playwright browsers / build cache | Medium |

## Step 3: Fix patterns  [HIGH freedom]

```yaml
# Concurrency — every workflow. CI/verification cancels superseded runs:
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

# Deploy/release: never cancel a live deploy. For combined verify-on-PR +
# deploy-on-push workflows, cancel PR churn only:
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
```

```yaml
# Expensive runner: dispatch/tag-only, not every push
build-ios:
  runs-on: macos-15
  if: ${{ inputs.platform == 'ios' || startsWith(github.ref, 'refs/tags/') }}
  timeout-minutes: 60   # cap runaway 10x spend

# Lean artifacts

From kensaurus/skills, MIT.

More from kensaurus/skills