facebook/react - GitHub Actions cost & CI smells

From the depmedic OSS benchmark dataset. Source: public workflow YAML in facebook/react/.github/workflows.

Workflows

Per-run $ (modeled)

$16.19

Monthly $ @ 30/day

$14,572.8

ci-doctor findings

Numbers are modeled: 8 minutes per priced job, 30 runs per day per workflow, 30-day month, GitHub-hosted runner rate sheet. facebook/react's real run frequency is unknown to me. Smells, however, are real - they come from parsing the actual YAML.

Findings by rule

Rule	Hits
`missing-timeout`	57
`artifact-no-retention`	18
`missing-concurrency`	7
`stale-cache-key`	4
`matrix-overcommit`	4
`missing-cache`	1

Per-workflow breakdown

Workflow	Jobs	Per-run $	Findings
`runtime_build_and_test.yml`	20	$12.99	34
`devtools_regression_tests.yml`	4	$0.83	11
`runtime_eslint_plugin_e2e.yml`	1	$0.32	1
`compiler_typescript.yml`	4	$0.26	4
`runtime_commit_artifacts.yml`	4	$0.26	7
`shared_lint.yml`	4	$0.26	4
`compiler_discord_notify.yml`	3	$0.13	3
`devtools_discord_notify.yml`	3	$0.13	3
`runtime_discord_notify.yml`	3	$0.13	3
`runtime_releases_from_npm_manual.yml`	2	$0.13	3
`shared_label_core_team_prs.yml`	3	$0.13	3
`compiler_playground.yml`	1	$0.06	3
`compiler_prereleases.yml`	1	$0.06	1
`runtime_fuzz_tests.yml`	1	$0.06	2
`runtime_prereleases.yml`	1	$0.06	1
`runtime_prereleases_manual.yml`	3	$0.06	1
`shared_check_maintainer.yml`	1	$0.06	1
`shared_cleanup_merged_branch_caches.yml`	1	$0.06	2
`shared_cleanup_stale_branch_caches.yml`	1	$0.06	1
`shared_close_direct_sync_branch_prs.yml`	1	$0.06	2
`shared_stale.yml`	1	$0.06	1
`compiler_prereleases_manual.yml`	1	$0.00	0
`compiler_prereleases_nightly.yml`	1	$0.00	0
`runtime_prereleases_nightly.yml`	2	$0.00	0

Examples of what ci-doctor reports

runtime_build_and_test.yml · WARN missing-cache
actions/setup-java has no cache option. Add 'with: cache: <ecosystem>' to skip dep re-downloads. Saves 30-90 seconds per run.

runtime_build_and_test.yml · WARN missing-timeout
Job 'runtime_node_modules_cache' has no timeout-minutes. Default is 360 (6h). A hung job can drain your CI budget.

runtime_build_and_test.yml · WARN missing-timeout
Job 'runtime_compiler_node_modules_cache' has no timeout-minutes. Default is 360 (6h). A hung job can drain your CI budget.

devtools_regression_tests.yml · WARN missing-timeout
Job 'download_build' has no timeout-minutes. Default is 360 (6h). A hung job can drain your CI budget.

devtools_regression_tests.yml · WARN missing-timeout
Job 'build_devtools_and_process_artifacts' has no timeout-minutes. Default is 360 (6h). A hung job can drain your CI budget.

devtools_regression_tests.yml · WARN missing-timeout
Job 'run_devtools_tests_for_versions' has no timeout-minutes. Default is 360 (6h). A hung job can drain your CI budget.

What you can do

If you maintain facebook/react or a similar workflow shape, three patterns probably move the most dollars per minute of work:

Add a concurrency: block with cancel-in-progress: true on every PR-triggered workflow.
Set timeout-minutes on every job (default is 6 hours).
Make sure every setup-* action sets cache: <ecosystem>.

Free CLIs that automate the audit and the pin step:

npx ci-doctor             # 14-rule audit
npx ci-doctor --fix       # auto-apply the four safe fixes
npx pin-actions           # pin every uses: ref to a SHA
npx gha-budget            # estimate per-run $ + monthly

About this dataset