sveltejs/svelte - GitHub Actions cost & CI smells

From the depmedic OSS benchmark dataset. Source: public workflow YAML in sveltejs/svelte/.github/workflows.

Workflows

Per-run $ (modeled)

$0.70

Monthly $ @ 30/day

$633.6

ci-doctor findings

Numbers are modeled: 8 minutes per priced job, 30 runs per day per workflow, 30-day month, GitHub-hosted runner rate sheet. sveltejs/svelte's real run frequency is unknown to me. Smells, however, are real - they come from parsing the actual YAML.

Findings by rule

Rule	Hits
`missing-timeout`	7
`missing-concurrency`	2
`artifact-no-retention`	2
`matrix-overcommit`	1
`fail-fast-true`	1
`fetch-depth-zero`	1

Per-workflow breakdown

Workflow	Jobs	Per-run $	Findings
`ci.yml`	5	$0.26	3
`pkg.pr.new.yml`	4	$0.26	7
`autofix.yml`	1	$0.06	1
`ecosystem-ci-trigger.yml`	1	$0.06	1
`release.yml`	1	$0.06	2

Examples of what ci-doctor reports

ci.yml · WARN missing-concurrency
No top-level concurrency block. New pushes will not cancel in-flight runs of stale commits, doubling spend on rapid-push branches.

ci.yml · WARN matrix-overcommit
Job 'Tests' matrix produces 7 combinations. Reduce the cross-product or move expensive runners behind a 'workflow_dispatch' or scheduled run.

ci.yml · INFO fail-fast-true
matrix job 'Tests' has the default fail-fast: true. The first cell that fails cancels every sibling - you still pay for the cancelled minutes, and you only see one failure per run instead of all of them.

pkg.pr.new.yml · WARN missing-concurrency
No top-level concurrency block. New pushes will not cancel in-flight runs of stale commits, doubling spend on rapid-push branches.

pkg.pr.new.yml · WARN missing-timeout
Job 'build' has no timeout-minutes. Default is 360 (6h). A hung job can drain your CI budget.

pkg.pr.new.yml · WARN missing-timeout
Job 'sanitize' has no timeout-minutes. Default is 360 (6h). A hung job can drain your CI budget.

What you can do

If you maintain sveltejs/svelte or a similar workflow shape, three patterns probably move the most dollars per minute of work:

Add a concurrency: block with cancel-in-progress: true on every PR-triggered workflow.
Set timeout-minutes on every job (default is 6 hours).
Make sure every setup-* action sets cache: <ecosystem>.

Free CLIs that automate the audit and the pin step:

npx ci-doctor             # 14-rule audit
npx ci-doctor --fix       # auto-apply the four safe fixes
npx pin-actions           # pin every uses: ref to a SHA
npx gha-budget            # estimate per-run $ + monthly

About this dataset