depmedic / benchmarks / parcel-bundler/parcel

parcel-bundler/parcel - GitHub Actions cost & CI smells

From the depmedic OSS benchmark dataset. Source: public workflow YAML in parcel-bundler/parcel/.github/workflows.

Workflows
6
Per-run $ (modeled)
$0.90
Monthly $ @ 30/day
$806.4
ci-doctor findings
52
Numbers are modeled: 8 minutes per priced job, 30 runs per day per workflow, 30-day month, GitHub-hosted runner rate sheet. parcel-bundler/parcel's real run frequency is unknown to me. Smells, however, are real - they come from parsing the actual YAML.

Findings by rule

RuleHits
pinned-action-sha28
missing-timeout12
missing-permissions3
artifact-no-retention3
matrix-overcommit3
missing-concurrency1
fail-fast-true1
fetch-depth-zero1

Per-workflow breakdown

Workflow Jobs Per-run $ Findings
release.yml 3 $0.45 18
ci.yml 7 $0.32 23
stale.yml 1 $0.06 2
tag-release.yml 2 $0.06 7
canary-release.yml 1 $0.00 1
dev-release.yml 1 $0.00 1

Examples of what ci-doctor reports

release.yml · WARN pinned-action-sha
dtolnay/rust-toolchain@master is not SHA-pinned. Mutable refs let upstream replace the action under you. Pin to a 40-char commit SHA and add a comment with the version. Run `npx pin-actions` to do all pins automatically.
release.yml · WARN pinned-action-sha
bahmutov/npm-install@v1.8.35 is not SHA-pinned. Mutable refs let upstream replace the action under you. Pin to a 40-char commit SHA and add a comment with the version. Run `npx pin-actions` to do all pins automatically.
release.yml · WARN pinned-action-sha
Swatinem/rust-cache@v2 is not SHA-pinned. Mutable refs let upstream replace the action under you. Pin to a 40-char commit SHA and add a comment with the version. Run `npx pin-actions` to do all pins automatically.
ci.yml · WARN pinned-action-sha
dtolnay/rust-toolchain@master is not SHA-pinned. Mutable refs let upstream replace the action under you. Pin to a 40-char commit SHA and add a comment with the version. Run `npx pin-actions` to do all pins automatically.
ci.yml · WARN pinned-action-sha
parcel-bundler/parcel-benchmark-action@master is not SHA-pinned. Mutable refs let upstream replace the action under you. Pin to a 40-char commit SHA and add a comment with the version. Run `npx pin-actions` to do all pins automatically.
ci.yml · WARN pinned-action-sha
dtolnay/rust-toolchain@master is not SHA-pinned. Mutable refs let upstream replace the action under you. Pin to a 40-char commit SHA and add a comment with the version. Run `npx pin-actions` to do all pins automatically.

What you can do

If you maintain parcel-bundler/parcel or a similar workflow shape, three patterns probably move the most dollars per minute of work:

  1. Add a concurrency: block with cancel-in-progress: true on every PR-triggered workflow.
  2. Set timeout-minutes on every job (default is 6 hours).
  3. Make sure every setup-* action sets cache: <ecosystem>.

Free CLIs that automate the audit and the pin step:

npx ci-doctor             # 14-rule audit
npx ci-doctor --fix       # auto-apply the four safe fixes
npx pin-actions           # pin every uses: ref to a SHA
npx gha-budget            # estimate per-run $ + monthly

Want the full pattern set?

The Cut Your CI Bill cookbook is 30 paste-ready GitHub Actions patterns plus 5 hardened workflow templates. $19, one-time, MIT-licensed templates.

Get the cookbook

About this dataset

Methodology and code: /blog/oss-ci-cost-benchmarks.html. Compare with all 20 repos: /benchmarks.html. This page is regenerated when the benchmark dataset is refreshed.