Comfy-Org/comfy-aimdo GitHub Actions scorecardPublic GitHub Actions data, last 30 days. Updated .
Data sourced from public GitHub. GitSpider is not affiliated with or endorsed by this repository's owners. Request removal.
Biggest wins first, each with the exact config fix.
Build WheelsThe Docker build has no layer cache, so every run re-executes every layer from scratch. Add `cache-from: type=gha` / `cache-to: type=gha,mode=max` to the build step.
- uses: docker/build-push-action@v6
with:
cache-from: type=gha
cache-to: type=gha,mode=maxBuild WheelsAdd a `concurrency:` block keyed on branch to cancel superseded runs when devs push twice quickly.
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: trueCLA AssistantAdd a `concurrency:` block keyed on branch to cancel superseded runs when devs push twice quickly.
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: trueBuild WheelsNo job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 15Build Wheels`upload-artifact` has no `retention-days`, so artifacts keep up to 90 days (storage cost). Set e.g. `retention-days: 7`.
- uses: actions/upload-artifact@v4
with:
name: build
path: dist/
retention-days: 7Build WheelsRuns on every push/PR with no `paths:` filter, so docs-only changes still trigger full CI. Add a `paths:` filter if that's common.
on:
pull_request:
paths:
- 'src/**'
- 'package.json'Build WheelsmacOS bills ~10x and Windows ~2x a Linux minute. The cost estimate above assumes Linux, so your real spend is higher. Move any job that doesn't need them to `ubuntu-latest`.
jobs:
build:
runs-on: ubuntu-latest # ~10x cheaper than macos-latestBuild Wheelscheckout fetches the entire git history every run (`fetch-depth: 0`) and nothing in the workflow appears to read it. Remove the line; the default shallow clone is much faster on big repos. Keep it if a step genuinely needs history.
- uses: actions/checkout@v4
# fetch-depth: 0 removed — default shallow clone is enough hereBuild Wheels2 third-party actions pinned to a branch or other mutable ref, which can change under you (supply-chain risk, non-reproducible builds). Pin to a full commit SHA instead. (1 more on a major-version tag like @v4; consider full-SHA pinning there too.)
uses: pypa/gh-action-pypi-publish@<full-sha> # was @release/v1CLA AssistantNo job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 15# Docker build without layer cache (applies to: Build Wheels)
- uses: docker/build-push-action@v6
with:
cache-from: type=gha
cache-to: type=gha,mode=max
# No concurrency control (applies to: Build Wheels, CLA Assistant)
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
# No job timeout (applies to: Build Wheels, CLA Assistant)
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 15
# Artifacts at default retention (applies to: Build Wheels)
- uses: actions/upload-artifact@v4
with:
name: build
path: dist/
retention-days: 7
# No path filters on triggers (applies to: Build Wheels)
on:
pull_request:
paths:
- 'src/**'
- 'package.json'
# Premium runners (macOS / Windows) (applies to: Build Wheels)
jobs:
build:
runs-on: ubuntu-latest # ~10x cheaper than macos-latest
# Full-history clone (fetch-depth: 0) (applies to: Build Wheels)
- uses: actions/checkout@v4
# fetch-depth: 0 removed — default shallow clone is enough here
# Third-party actions pinned to a mutable ref (applies to: Build Wheels)
uses: pypa/gh-action-pypi-publish@<full-sha> # was @release/v1Each snippet is representative. Merge into the named workflow files rather than pasting wholesale.
This scorecard is a one-time snapshot. Install the free GitHub App to track this repo continuously: new regressions caught as they land, trends over time, on your public and private repos. Team adds the offending commit on the PR + Slack alerts.
Install & monitor this repo →💬 On Team, this same analysis posts automatically to every PR: the regression, and the exact commit that caused it, right where your team already looks. See plans →
Not ready to install? Get this report by email. No spam, unsubscribe anytime.