denoland/deno - GitHub Actions cost & CI smells

From the depmedic OSS benchmark dataset. Source: public workflow YAML in denoland/deno/.github/workflows.

Workflows

Per-run $ (modeled)

$18.30

Monthly $ @ 30/day

$16,473.6

ci-doctor findings

Numbers are modeled: 8 minutes per priced job, 30 runs per day per workflow, 30-day month, GitHub-hosted runner rate sheet. denoland/deno's real run frequency is unknown to me. Smells, however, are real - they come from parsing the actual YAML.

Findings by rule

Rule	Hits
`missing-cache`	23
`artifact-no-retention`	13
`matrix-overcommit`	13
`stale-cache-key`	12
`missing-timeout`	11
`expensive-runner`	11
`missing-permissions`	10
`fail-fast-true`	3

Per-workflow breakdown

Workflow	Jobs	Per-run $	Findings
`ci.generated.yml`	36	$16.90	67
`promote_to_release.generated.yml`	2	$0.77	5
`npm_publish.generated.yml`	3	$0.13	3
`cargo_publish.generated.yml`	1	$0.06	2
`create_prerelease_tag.generated.yml`	1	$0.06	2
`ecosystem_compat_test.generated.yml`	2	$0.06	6
`node_compat_test.generated.yml`	2	$0.06	7
`post_publish.generated.yml`	1	$0.06	2
`pr.generated.yml`	1	$0.06	3
`start_release.generated.yml`	1	$0.06	1
`version_bump.generated.yml`	1	$0.06	1

Examples of what ci-doctor reports

ci.generated.yml · WARN missing-cache
actions/setup-node has no cache option. Add 'with: cache: <ecosystem>' to skip dep re-downloads. Saves 30-90 seconds per run.

promote_to_release.generated.yml · WARN missing-timeout
Job 'promote-to-release-windows' has no timeout-minutes. Default is 360 (6h). A hung job can drain your CI budget.

promote_to_release.generated.yml · WARN missing-timeout
Job 'promote-to-release' has no timeout-minutes. Default is 360 (6h). A hung job can drain your CI budget.

promote_to_release.generated.yml · WARN expensive-runner
Job 'promote-to-release-windows' runs on windows-2022 but has no platform-specific commands detected. ubuntu-latest costs 2x less.

What you can do

If you maintain denoland/deno or a similar workflow shape, three patterns probably move the most dollars per minute of work:

Add a concurrency: block with cancel-in-progress: true on every PR-triggered workflow.
Set timeout-minutes on every job (default is 6 hours).
Make sure every setup-* action sets cache: <ecosystem>.

Free CLIs that automate the audit and the pin step:

npx ci-doctor             # 14-rule audit
npx ci-doctor --fix       # auto-apply the four safe fixes
npx pin-actions           # pin every uses: ref to a SHA
npx gha-budget            # estimate per-run $ + monthly

About this dataset