Where the minutes go (30d)
Waste detected
Biggest wins first, each with the exact config fix.
Docker build without layer cache · build
The Docker build has no layer cache, so every run re-executes every layer from scratch. Add `cache-from: type=gha` / `cache-to: type=gha,mode=max` to the build step.
- uses: docker/build-push-action@v6
with:
cache-from: type=gha
cache-to: type=gha,mode=maxWorkflow failing almost every run · Docker
Fails or times out on nearly all recent runs, burning minutes to produce only red, and an always-red workflow usually gets ignored. Fix it, or disable the trigger until it's ready.
Workflow failing almost every run · CxFlow
Fails or times out on nearly all recent runs, burning minutes to produce only red, and an always-red workflow usually gets ignored. Fix it, or disable the trigger until it's ready.
Workflow failing almost every run · ESLint
Fails or times out on nearly all recent runs, burning minutes to produce only red, and an always-red workflow usually gets ignored. Fix it, or disable the trigger until it's ready.
Workflow failing almost every run · Anchore Grype vulnerability scan
Fails or times out on nearly all recent runs, burning minutes to produce only red, and an always-red workflow usually gets ignored. Fix it, or disable the trigger until it's ready.
Workflow failing almost every run · Sysdig - Build, scan, push and upload sarif report
Fails or times out on nearly all recent runs, burning minutes to produce only red, and an always-red workflow usually gets ignored. Fix it, or disable the trigger until it's ready.
Docker build without layer cache · Anchore Grype vulnerability scan
The Docker build has no layer cache, so every run re-executes every layer from scratch. Add `cache-from: type=gha` / `cache-to: type=gha,mode=max` to the build step.
- uses: docker/build-push-action@v6
with:
cache-from: type=gha
cache-to: type=gha,mode=maxWorkflow failing almost every run · Cloudrail
Fails or times out on nearly all recent runs, burning minutes to produce only red, and an always-red workflow usually gets ignored. Fix it, or disable the trigger until it's ready.
No concurrency control · Docker
Add a `concurrency:` block keyed on branch to cancel superseded runs when devs push twice quickly.
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: trueMissing dependency cache · ESLint
Set `cache: 'npm'` on your `actions/setup-node` step, or add an `actions/cache@v4` step keyed on your lockfile.
- uses: actions/setup-node@v4
with:
node-version: 20
cache: 'npm'Docker build without layer cache · Sysdig - Build, scan, push and upload sarif report
The Docker build has no layer cache, so every run re-executes every layer from scratch. Add `cache-from: type=gha` / `cache-to: type=gha,mode=max` to the build step.
- uses: docker/build-push-action@v6
with:
cache-from: type=gha
cache-to: type=gha,mode=maxMissing dependency cache · NodeJS with Webpack
Set `cache: 'npm'` on your `actions/setup-node` step, or add an `actions/cache@v4` step keyed on your lockfile.
- uses: actions/setup-node@v4
with:
node-version: 20
cache: 'npm'Also found: 84 more config fixes with negligible recoverable minutes — timeouts, retention, path filters
No job timeout · .github/workflows/action.yml
No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 15No job timeout · Anchore Grype vulnerability scan
No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 15Scheduled workflow runs in forks · Anchore Grype vulnerability scan
The schedule has no repository guard, so forks that enable Actions inherit the cron and burn their own minutes. Gate the job with `if: github.repository == 'owner/repo'`.
jobs:
nightly:
if: github.repository == 'owner/repo'
runs-on: ubuntu-latestNo job timeout · .github/workflows/android.yml
No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 15No job timeout · .github/workflows/apisec-scan.yml
No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 15Missing dependency cache · .github/workflows/autofix-ci.yml
`actions/setup-go@v4+` caches modules and build output by default, so upgrading to v4 or newer is the fix.
# actions/setup-go@v4+ caches modules and build output by default;
# upgrading to v4 or newer is the fix.
- uses: actions/setup-go@v5
with:
go-version: '1.22'No job timeout · .github/workflows/autofix-ci.yml
No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 15System packages reinstalled every run · .github/workflows/autofix-ci.yml
System packages install from the network on every run with no cache. Cache them (cache-apt-pkgs-action) or check whether the runner image already has the tool.
- uses: awalsh128/cache-apt-pkgs-action@latest
with:
packages: <your packages>
version: 1.0No job timeout · .github/workflows/azure-pipelines.yml
No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 15No job timeout · C/C++ CI
No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 15No job timeout · CxFlow
No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 15No job timeout · Cloudrail
No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 15Scheduled workflow runs in forks · Cloudrail
The schedule has no repository guard, so forks that enable Actions inherit the cron and burn their own minutes. Gate the job with `if: github.repository == 'owner/repo'`.
jobs:
nightly:
if: github.repository == 'owner/repo'
runs-on: ubuntu-latestNo job timeout · .github/workflows/cmake.yml
No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 15No job timeout · Codacy Security Scan
No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 15Scheduled workflow runs in forks · Codacy Security Scan
The schedule has no repository guard, so forks that enable Actions inherit the cron and burn their own minutes. Gate the job with `if: github.repository == 'owner/repo'`.
jobs:
nightly:
if: github.repository == 'owner/repo'
runs-on: ubuntu-latestNo job timeout · .github/workflows/codeql.yml
No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 15No job timeout · CRDA Scan
No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 15No job timeout · Dart
No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 15No job timeout · Datree Workflow
No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 15No job timeout · .github/workflows/dependency-review.yaml
No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 15No job timeout · Docker Image CI
No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 15Docker build without layer cache · Docker Image CI
The Docker build has no layer cache, so every run re-executes every layer from scratch. Add `cache-from: type=gha` / `cache-to: type=gha,mode=max` to the build step.
- uses: docker/build-push-action@v6
with:
cache-from: type=gha
cache-to: type=gha,mode=maxNo job timeout · Docker
No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 15No path filters on triggers · Docker
Runs on every push/PR with no `paths:` filter, so docs-only changes still trigger full CI. Add a `paths:` filter if that's common.
on:
pull_request:
paths:
- 'src/**'
- 'package.json'No job timeout · .NET
No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 15No job timeout · ESLint
No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 15Scheduled workflow runs in forks · ESLint
The schedule has no repository guard, so forks that enable Actions inherit the cron and burn their own minutes. Gate the job with `if: github.repository == 'owner/repo'`.
jobs:
nightly:
if: github.repository == 'owner/repo'
runs-on: ubuntu-latestNo job timeout · .github/workflows/ethicalcheck.yml
No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 15No job timeout · Ruby Gem
No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 15No job timeout · Go
No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 15Missing dependency cache · .github/workflows/gradle.yml
Set `cache: 'gradle'` on your `actions/setup-java` step, or add an `actions/cache@v4` step keyed on your build file.
- uses: actions/setup-java@v4
with:
distribution: 'temurin'
java-version: '21'
cache: 'gradle'No job timeout · .github/workflows/gradle.yml
No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 15No job timeout · .github/workflows/jekyll-gh-pages.yml
No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 15cancel-in-progress on a deploy workflow · .github/workflows/jekyll-gh-pages.yml
This looks like a deploy/release workflow with `cancel-in-progress: true`, which cancels queued runs too — a queued deploy is silently dropped when a newer run arrives. Use a group-only `concurrency:` block on deploys.
concurrency:
group: ${{ github.workflow }}
# queued deploys run in order; none are droppedNo job timeout · Makefile CI
No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 15No job timeout · MobSF
No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 15Scheduled workflow runs in forks · MobSF
The schedule has no repository guard, so forks that enable Actions inherit the cron and burn their own minutes. Gate the job with `if: github.repository == 'owner/repo'`.
jobs:
nightly:
if: github.repository == 'owner/repo'
runs-on: ubuntu-latestNo job timeout · MSBuild
No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 15Premium runners (macOS / Windows) · MSBuild
macOS bills ~10× and Windows ~2× a Linux minute. The cost estimate above assumes Linux, so your real spend is higher. Move any job that doesn't need them to `ubuntu-latest`.
jobs:
build:
runs-on: ubuntu-latest # ~10x cheaper than macos-latestNo job timeout · Microsoft C++ Code Analysis
No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 15Artifacts at default retention · Microsoft C++ Code Analysis
`upload-artifact` has no `retention-days`, so artifacts keep up to 90 days (storage cost). Set e.g. `retention-days: 7`.
- uses: actions/upload-artifact@v4
with:
name: build
path: dist/
retention-days: 7Premium runners (macOS / Windows) · Microsoft C++ Code Analysis
macOS bills ~10× and Windows ~2× a Linux minute. The cost estimate above assumes Linux, so your real spend is higher. Move any job that doesn't need them to `ubuntu-latest`.
jobs:
build:
runs-on: ubuntu-latest # ~10x cheaper than macos-latestScheduled workflow runs in forks · Microsoft C++ Code Analysis
The schedule has no repository guard, so forks that enable Actions inherit the cron and burn their own minutes. Gate the job with `if: github.repository == 'owner/repo'`.
jobs:
nightly:
if: github.repository == 'owner/repo'
runs-on: ubuntu-latestNo job timeout · njsscan sarif
No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 15Scheduled workflow runs in forks · njsscan sarif
The schedule has no repository guard, so forks that enable Actions inherit the cron and burn their own minutes. Gate the job with `if: github.repository == 'owner/repo'`.
jobs:
nightly:
if: github.repository == 'owner/repo'
runs-on: ubuntu-latestNo job timeout · .github/workflows/nowsecure-mobile-sbom.yml
No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 15Scheduled workflow runs in forks · .github/workflows/nowsecure-mobile-sbom.yml
The schedule has no repository guard, so forks that enable Actions inherit the cron and burn their own minutes. Gate the job with `if: github.repository == 'owner/repo'`.
jobs:
nightly:
if: github.repository == 'owner/repo'
runs-on: ubuntu-latestNo job timeout · .github/workflows/nowsecure.yml
No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 15No job timeout · .github/workflows/ops.static-analysis.yml
No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 15No job timeout · .github/workflows/ossar.yml
No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 15Premium runners (macOS / Windows) · .github/workflows/ossar.yml
macOS bills ~10× and Windows ~2× a Linux minute. The cost estimate above assumes Linux, so your real spend is higher. Move any job that doesn't need them to `ubuntu-latest`.
jobs:
build:
runs-on: ubuntu-latest # ~10x cheaper than macos-latestNo job timeout · PSScriptAnalyzer
No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 15Scheduled workflow runs in forks · PSScriptAnalyzer
The schedule has no repository guard, so forks that enable Actions inherit the cron and burn their own minutes. Gate the job with `if: github.repository == 'owner/repo'`.
jobs:
nightly:
if: github.repository == 'owner/repo'
runs-on: ubuntu-latestMissing dependency cache · .github/workflows/publish.yaml
Set `cache: 'npm'` on your `actions/setup-node` step, or add an `actions/cache@v4` step keyed on your lockfile.
- uses: actions/setup-node@v4
with:
node-version: 20
cache: 'npm'No job timeout · .github/workflows/publish.yaml
No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 15No job timeout · .github/workflows/pylint.yml
No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 15No job timeout · .github/workflows/pysa.yml
No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 15Missing dependency cache · .github/workflows/python-app.yml
Set `cache: 'pip'` on your `actions/setup-python` step, or add an `actions/cache@v4` step keyed on your requirements/lock file.
- uses: actions/setup-python@v5
with:
python-version: '3.12'
cache: 'pip'No job timeout · .github/workflows/python-app.yml
No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 15No job timeout · .github/workflows/python-package-conda.yml
No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 15No job timeout · .github/workflows/python-publish.yml
No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 15No job timeout · R
No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 15Premium runners (macOS / Windows) · R
macOS bills ~10× and Windows ~2× a Linux minute. The cost estimate above assumes Linux, so your real spend is higher. Move any job that doesn't need them to `ubuntu-latest`.
jobs:
build:
runs-on: ubuntu-latest # ~10x cheaper than macos-latestNo job timeout · .github/workflows/rubocop.yml
No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 15No job timeout · Ruby on Rails CI
No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 15No job timeout · .github/workflows/rust-clippy.yml
No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 15Missing dependency cache · Rust
Add `Swatinem/rust-cache@v2` (the de-facto cargo cache), or an `actions/cache@v4` step keyed on `Cargo.lock`.
- uses: Swatinem/rust-cache@v2No job timeout · Rust
No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 15No job timeout · Semgrep
No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 15Scheduled workflow runs in forks · Semgrep
The schedule has no repository guard, so forks that enable Actions inherit the cron and burn their own minutes. Gate the job with `if: github.repository == 'owner/repo'`.
jobs:
nightly:
if: github.repository == 'owner/repo'
runs-on: ubuntu-latestNo job timeout · SOOS DAST Scan
No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 15No job timeout · StackHawk
No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 15Scheduled workflow runs in forks · StackHawk
The schedule has no repository guard, so forks that enable Actions inherit the cron and burn their own minutes. Gate the job with `if: github.repository == 'owner/repo'`.
jobs:
nightly:
if: github.repository == 'owner/repo'
runs-on: ubuntu-latestNo concurrency control · Mark stale issues and pull requests
Add a `concurrency:` block keyed on branch to cancel superseded runs when devs push twice quickly.
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: trueNo job timeout · Mark stale issues and pull requests
No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 15Scheduled workflow runs in forks · Mark stale issues and pull requests
The schedule has no repository guard, so forks that enable Actions inherit the cron and burn their own minutes. Gate the job with `if: github.repository == 'owner/repo'`.
jobs:
nightly:
if: github.repository == 'owner/repo'
runs-on: ubuntu-latestNo job timeout · .github/workflows/static.yml
No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 15Missing dependency cache · .github/workflows/super-linter.yml
Set `cache: 'npm'` on your `actions/setup-node` step, or add an `actions/cache@v4` step keyed on your lockfile.
- uses: actions/setup-node@v4
with:
node-version: 20
cache: 'npm'No job timeout · .github/workflows/super-linter.yml
No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 15No job timeout · Sysdig - Build, scan, push and upload sarif report
No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 15No job timeout · build
No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 15Scheduled workflow runs in forks · build
The schedule has no repository guard, so forks that enable Actions inherit the cron and burn their own minutes. Gate the job with `if: github.repository == 'owner/repo'`.
jobs:
nightly:
if: github.repository == 'owner/repo'
runs-on: ubuntu-latestNo job timeout · NodeJS with Webpack
No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 15Copy every fix as one block (14 snippets, annotated per workflow)
# Docker build without layer cache — applies to: build, Anchore Grype vulnerability scan, Sysdig - Build, scan, push and upload sarif report, Docker Image CI
- uses: docker/build-push-action@v6
with:
cache-from: type=gha
cache-to: type=gha,mode=max
# No concurrency control — applies to: Docker, Mark stale issues and pull requests
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
# Missing dependency cache (npm) — applies to: ESLint, NodeJS with Webpack, .github/workflows/publish.yaml, .github/workflows/super-linter.yml
- uses: actions/setup-node@v4
with:
node-version: 20
cache: 'npm'
# No job timeout — applies to: .github/workflows/action.yml, Anchore Grype vulnerability scan, .github/workflows/android.yml, .github/workflows/apisec-scan.yml, .github/workflows/autofix-ci.yml, .github/workflows/azure-pipelines.yml, C/C++ CI, CxFlow, Cloudrail, .github/workflows/cmake.yml, Codacy Security Scan, .github/workflows/codeql.yml, CRDA Scan, Dart, Datree Workflow, .github/workflows/dependency-review.yaml, Docker Image CI, Docker, .NET, ESLint, .github/workflows/ethicalcheck.yml, Ruby Gem, Go, .github/workflows/gradle.yml, .github/workflows/jekyll-gh-pages.yml, Makefile CI, MobSF, MSBuild, Microsoft C++ Code Analysis, njsscan sarif, .github/workflows/nowsecure-mobile-sbom.yml, .github/workflows/nowsecure.yml, .github/workflows/ops.static-analysis.yml, .github/workflows/ossar.yml, PSScriptAnalyzer, .github/workflows/publish.yaml, .github/workflows/pylint.yml, .github/workflows/pysa.yml, .github/workflows/python-app.yml, .github/workflows/python-package-conda.yml, .github/workflows/python-publish.yml, R, .github/workflows/rubocop.yml, Ruby on Rails CI, .github/workflows/rust-clippy.yml, Rust, Semgrep, SOOS DAST Scan, StackHawk, Mark stale issues and pull requests, .github/workflows/static.yml, .github/workflows/super-linter.yml, Sysdig - Build, scan, push and upload sarif report, build, NodeJS with Webpack
jobs:
build:
runs-on: ubuntu-latest
timeout-minutes: 15
# Scheduled workflow runs in forks — applies to: Anchore Grype vulnerability scan, Cloudrail, Codacy Security Scan, ESLint, MobSF, Microsoft C++ Code Analysis, njsscan sarif, .github/workflows/nowsecure-mobile-sbom.yml, PSScriptAnalyzer, Semgrep, StackHawk, Mark stale issues and pull requests, build
jobs:
nightly:
if: github.repository == 'owner/repo'
runs-on: ubuntu-latest
# Missing dependency cache (go) — applies to: .github/workflows/autofix-ci.yml
# actions/setup-go@v4+ caches modules and build output by default;
# upgrading to v4 or newer is the fix.
- uses: actions/setup-go@v5
with:
go-version: '1.22'
# System packages reinstalled every run — applies to: .github/workflows/autofix-ci.yml
- uses: awalsh128/cache-apt-pkgs-action@latest
with:
packages: <your packages>
version: 1.0
# No path filters on triggers — applies to: Docker
on:
pull_request:
paths:
- 'src/**'
- 'package.json'
# Missing dependency cache (gradle) — applies to: .github/workflows/gradle.yml
- uses: actions/setup-java@v4
with:
distribution: 'temurin'
java-version: '21'
cache: 'gradle'
# cancel-in-progress on a deploy workflow — applies to: .github/workflows/jekyll-gh-pages.yml
concurrency:
group: ${{ github.workflow }}
# queued deploys run in order; none are dropped
# Premium runners (macOS / Windows) — applies to: MSBuild, Microsoft C++ Code Analysis, .github/workflows/ossar.yml, R
jobs:
build:
runs-on: ubuntu-latest # ~10x cheaper than macos-latest
# Artifacts at default retention — applies to: Microsoft C++ Code Analysis
- uses: actions/upload-artifact@v4
with:
name: build
path: dist/
retention-days: 7
# Missing dependency cache (pip) — applies to: .github/workflows/python-app.yml
- uses: actions/setup-python@v5
with:
python-version: '3.12'
cache: 'pip'
# Missing dependency cache (cargo) — applies to: Rust
- uses: Swatinem/rust-cache@v2Each snippet is representative — merge into the named workflow files rather than pasting wholesale.
Want this on every push?
This scorecard is a one-time snapshot. Install the free GitHub App to track this repo continuously: new regressions caught as they land, trends over time, on your public and private repos. Team adds the offending commit on the PR + Slack alerts.
Install & monitor this repo →Not ready to install? Get this report by email. No spam, unsubscribe anytime.
Live CI-health badge → 
[](https://gitspider.com/scan/ah-ha-admin/ah-ha)