GitSpider

huggingface/transformers GitHub Actions scorecard

Public GitHub Actions data, last 30 days. Updated .

Data sourced from public GitHub. GitSpider is not affiliated with or endorsed by this repository's owners. Request removal.

27 min/mo
recoverable (~1% of CI time) · across 33 patterns
Estimated from wall-clock time · public repos pay $0, $ = private-repo equivalent
See all 33 fixes, each with the exact YAML ↓
7.2%
failure rate, 30d
6m
avg time to recover from a failure
Since : findings 32 → 33 · recoverable ~87 → ~27 min/mo
79 workflows · 2,500 runs (83.3/day) · 2,743 CI-min (wall-clock) · ≈$16 at private-repo rates (30d)
CI minutes, cost and failure rate are from the latest 500 of 2,500 runs.

Where the minutes go (30d)

PR CI~381 min · 40 runs
Self-hosted runner scale set (AMD mi355 scheduled CI caller)~360 min · 2 runs
Self-hosted runner (AMD mi250 scheduled CI caller)~360 min · 2 runs
or track on every push →

Waste detected

Biggest wins first, each with the exact config fix.

Missing dependency cache · Self-hosted runner (benchmark)

~7 min/mo

Set `cache: 'pip'` on your `actions/setup-python` step, or add an `actions/cache@v4` step keyed on your requirements/lock file.

- uses: actions/setup-python@v5
  with:
    python-version: '3.12'
    cache: 'pip'

Full guide: how to fix this →

No concurrency control · Upload PR Documentation

~5 min/mo

Add a `concurrency:` block keyed on branch to cancel superseded runs when devs push twice quickly.

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

Full guide: how to fix this →

No concurrency control · Secret Leaks

~5 min/mo

Add a `concurrency:` block keyed on branch to cancel superseded runs when devs push twice quickly.

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

Full guide: how to fix this →

No concurrency control · PR slow CI - Suggestion

~4 min/mo

Add a `concurrency:` block keyed on branch to cancel superseded runs when devs push twice quickly.

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

Full guide: how to fix this →

No concurrency control · Post CI Dashboard Link

~3 min/mo

Add a `concurrency:` block keyed on branch to cancel superseded runs when devs push twice quickly.

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

Full guide: how to fix this →

No concurrency control · PR CI Security Gate

~3 min/mo

Add a `concurrency:` block keyed on branch to cancel superseded runs when devs push twice quickly.

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

Full guide: how to fix this →

Also found: 27 more config fixes with negligible recoverable minutes: timeouts, retention, path filters

No job timeout · Build PR Documentation

~0 min/mo

No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.

jobs:
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 15

Full guide: how to fix this →

No path filters on triggers · Build PR Documentation

~0 min/mo

Runs on every push/PR with no `paths:` filter, so docs-only changes still trigger full CI. Add a `paths:` filter if that's common.

on:
  pull_request:
    paths:
      - 'src/**'
      - 'package.json'

Full guide: how to fix this →

No job timeout · Upload PR Documentation

~0 min/mo

No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.

jobs:
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 15

Full guide: how to fix this →

No job timeout · Self-hosted runner (benchmark)

~0 min/mo

No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.

jobs:
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 15

Full guide: how to fix this →

No path filters on triggers · Self-hosted runner (benchmark)

~0 min/mo

Runs on every push/PR with no `paths:` filter, so docs-only changes still trigger full CI. Add a `paths:` filter if that's common.

on:
  pull_request:
    paths:
      - 'src/**'
      - 'package.json'

Full guide: how to fix this →

No job timeout · Secret Leaks

~0 min/mo

No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.

jobs:
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 15

Full guide: how to fix this →

Full-history clone (fetch-depth: 0) · Secret Leaks

~0 min/mo

checkout fetches the entire git history every run (`fetch-depth: 0`) and nothing in the workflow appears to read it. Remove the line; the default shallow clone is much faster on big repos. Keep it if a step genuinely needs history.

- uses: actions/checkout@v4
  # fetch-depth: 0 removed — default shallow clone is enough here

Full guide: how to fix this →

No job timeout · PR comment GitHub CI

~0 min/mo

No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.

jobs:
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 15

Full guide: how to fix this →

Third-party actions pinned to a mutable ref · PR comment GitHub CI

~0 min/mo

2 third-party actions pinned to a branch or other mutable ref, which can change under you (supply-chain risk, non-reproducible builds). Pin to a full commit SHA instead.

uses: huggingface/transformers-ci/.github/workflows/daily-ci_reusable.yml@<full-sha>  # was @main

No job timeout · PR - build doc via comment

~0 min/mo

No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.

jobs:
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 15

Full guide: how to fix this →

No job timeout · PR slow CI - Suggestion

~0 min/mo

No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.

jobs:
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 15

Full guide: how to fix this →

Full-history clone (fetch-depth: 0) · PR slow CI - Suggestion

~0 min/mo

checkout fetches the entire git history every run (`fetch-depth: 0`) and nothing in the workflow appears to read it. Remove the line; the default shallow clone is much faster on big repos. Keep it if a step genuinely needs history.

- uses: actions/checkout@v4
  # fetch-depth: 0 removed — default shallow clone is enough here

Full guide: how to fix this →

No job timeout · PR Repo. Consistency Bot

~0 min/mo

No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.

jobs:
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 15

Full guide: how to fix this →

Artifacts at default retention · PR Repo. Consistency Bot

~0 min/mo

`upload-artifact` has no `retention-days`, so artifacts keep up to 90 days (storage cost). Set e.g. `retention-days: 7`.

- uses: actions/upload-artifact@v4
  with:
    name: build
    path: dist/
    retention-days: 7

Full guide: how to fix this →

No job timeout · Anti-Slop

~0 min/mo

No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.

jobs:
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 15

Full guide: how to fix this →

No job timeout · PR CI

~0 min/mo

No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.

jobs:
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 15

Full guide: how to fix this →

No path filters on triggers · PR CI

~0 min/mo

Runs on every push/PR with no `paths:` filter, so docs-only changes still trigger full CI. Add a `paths:` filter if that's common.

on:
  pull_request:
    paths:
      - 'src/**'
      - 'package.json'

Full guide: how to fix this →

Third-party actions pinned to a mutable ref · PR CI

~0 min/mo

1 third-party action pinned to a branch or other mutable ref, which can change under you (supply-chain risk, non-reproducible builds). Pin to a full commit SHA instead.

uses: huggingface/transformers-ci/.github/workflows/pr-ci_dynamic_caller_example.yml@<full-sha>  # was @main

No job timeout · Post CI Dashboard Link

~0 min/mo

No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.

jobs:
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 15

Full guide: how to fix this →

No job timeout · PR CI Security Gate

~0 min/mo

No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.

jobs:
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 15

Full guide: how to fix this →

Third-party actions pinned to a mutable ref · PR CI Security Gate

~0 min/mo

1 third-party action pinned to a branch or other mutable ref, which can change under you (supply-chain risk, non-reproducible builds). Pin to a full commit SHA instead.

uses: huggingface/transformers-ci/.github/workflows/pr-ci-security-gate.yml@<full-sha>  # was @main

No job timeout · serge verify (GPU)

~0 min/mo

No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.

jobs:
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 15

Full guide: how to fix this →

Third-party actions pinned to a mutable ref · serge verify (GPU)

~0 min/mo

1 third-party action pinned to a branch or other mutable ref, which can change under you (supply-chain risk, non-reproducible builds). Pin to a full commit SHA instead.

uses: huggingface/transformers-ci/.github/workflows/serge-verify-slow.yml@<full-sha>  # was @main

No job timeout · AI Review with inline comments

~0 min/mo

No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.

jobs:
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 15

Full guide: how to fix this →

No job timeout · PR comment GitHub CI (AMD)

~0 min/mo

No job sets `timeout-minutes`, so a hung step can run to GitHub's 6-hour default. Add `timeout-minutes` to each job.

jobs:
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 15

Full guide: how to fix this →

Artifacts at default retention · PR comment GitHub CI (AMD)

~0 min/mo

`upload-artifact` has no `retention-days`, so artifacts keep up to 90 days (storage cost). Set e.g. `retention-days: 7`.

- uses: actions/upload-artifact@v4
  with:
    name: build
    path: dist/
    retention-days: 7

Full guide: how to fix this →

Third-party actions pinned to a mutable ref · PR comment GitHub CI (AMD)

~0 min/mo

1 third-party action pinned to a branch or other mutable ref, which can change under you (supply-chain risk, non-reproducible builds). Pin to a full commit SHA instead.

uses: huggingface/hf-workflows/.github/workflows/transformers_amd_ci_scheduled_arc_scale_set.yaml@<full-sha>  # was @main
Copy every fix as one block (11 snippets, annotated per workflow)
# Missing dependency cache (pip) (applies to: Self-hosted runner (benchmark))
- uses: actions/setup-python@v5
  with:
    python-version: '3.12'
    cache: 'pip'

# No concurrency control (applies to: Upload PR Documentation, Secret Leaks, PR slow CI - Suggestion, Post CI Dashboard Link, PR CI Security Gate)
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

# No job timeout (applies to: Build PR Documentation, Upload PR Documentation, Self-hosted runner (benchmark), Secret Leaks, PR comment GitHub CI, PR - build doc via comment, PR slow CI - Suggestion, PR Repo. Consistency Bot, Anti-Slop, PR CI, Post CI Dashboard Link, PR CI Security Gate, serge verify (GPU), AI Review with inline comments, PR comment GitHub CI (AMD))
jobs:
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 15

# No path filters on triggers (applies to: Build PR Documentation, Self-hosted runner (benchmark), PR CI)
on:
  pull_request:
    paths:
      - 'src/**'
      - 'package.json'

# Full-history clone (fetch-depth: 0) (applies to: Secret Leaks, PR slow CI - Suggestion)
- uses: actions/checkout@v4
  # fetch-depth: 0 removed — default shallow clone is enough here

# Third-party actions pinned to a mutable ref (applies to: PR comment GitHub CI)
uses: huggingface/transformers-ci/.github/workflows/daily-ci_reusable.yml@<full-sha>  # was @main

# Artifacts at default retention (applies to: PR Repo. Consistency Bot, PR comment GitHub CI (AMD))
- uses: actions/upload-artifact@v4
  with:
    name: build
    path: dist/
    retention-days: 7

# Third-party actions pinned to a mutable ref (applies to: PR CI)
uses: huggingface/transformers-ci/.github/workflows/pr-ci_dynamic_caller_example.yml@<full-sha>  # was @main

# Third-party actions pinned to a mutable ref (applies to: PR CI Security Gate)
uses: huggingface/transformers-ci/.github/workflows/pr-ci-security-gate.yml@<full-sha>  # was @main

# Third-party actions pinned to a mutable ref (applies to: serge verify (GPU))
uses: huggingface/transformers-ci/.github/workflows/serge-verify-slow.yml@<full-sha>  # was @main

# Third-party actions pinned to a mutable ref (applies to: PR comment GitHub CI (AMD))
uses: huggingface/hf-workflows/.github/workflows/transformers_amd_ci_scheduled_arc_scale_set.yaml@<full-sha>  # was @main

Each snippet is representative. Merge into the named workflow files rather than pasting wholesale.

Add the badge to your README

Live CI-health badge → GitSpider badge

[![GitSpider](https://gitspider.com/badge/huggingface/transformers.svg)](https://gitspider.com/scan/huggingface/transformers)

Want this on every push?

This scorecard is a one-time snapshot. Install the free GitHub App to track this repo continuously: new regressions caught as they land, trends over time, on your public and private repos. Team adds the offending commit on the PR + Slack alerts.

Install & monitor this repo →

💬 On Team, every PR gets an automatic comment when its CI run fails or runs slow, right where your team already looks. See plans →

Not ready to install? Get this report by email. No spam, unsubscribe anytime.

Share this scorecard: https://gitspider.com/scan/huggingface/transformers