webpack/webpack - GitHub Actions cost & CI smells

From the depmedic OSS benchmark dataset. Source: public workflow YAML in webpack/webpack/.github/workflows.

Workflows

Per-run $ (modeled)

$1.15

Monthly $ @ 30/day

$1,036.8

ci-doctor findings

Numbers are modeled: 8 minutes per priced job, 30 runs per day per workflow, 30-day month, GitHub-hosted runner rate sheet. webpack/webpack's real run frequency is unknown to me. Smells, however, are real - they come from parsing the actual YAML.

Findings by rule

Rule	Hits
`missing-timeout`	15
`fetch-depth-zero`	4
`missing-concurrency`	4
`missing-permissions`	1
`matrix-overcommit`	1

Per-workflow breakdown

Workflow	Jobs	Per-run $	Findings
`test.yml`	7	$0.45	9
`benchmarks.yml`	2	$0.32	4
`dependabot.yml`	1	$0.06	2
`dependency-review.yml`	1	$0.06	2
`examples.yml`	1	$0.06	2
`publish-to-pkg-pr-new.yml`	1	$0.06	2
`release-announcement.yml`	1	$0.06	2
`release.yml`	2	$0.06	1
`pr-quality.yml`	1	$0.00	1

Examples of what ci-doctor reports

test.yml · WARN missing-timeout
Job 'lint' has no timeout-minutes. Default is 360 (6h). A hung job can drain your CI budget.

test.yml · WARN missing-timeout
Job 'types-coverage' has no timeout-minutes. Default is 360 (6h). A hung job can drain your CI budget.

test.yml · WARN missing-timeout
Job 'validate-legacy-node' has no timeout-minutes. Default is 360 (6h). A hung job can drain your CI budget.

benchmarks.yml · WARN missing-timeout
Job 'benchmark' has no timeout-minutes. Default is 360 (6h). A hung job can drain your CI budget.

benchmarks.yml · WARN missing-timeout
Job 'benchmark-memory' has no timeout-minutes. Default is 360 (6h). A hung job can drain your CI budget.

benchmarks.yml · INFO fetch-depth-zero
fetch-depth: 0 pulls full git history. Slow on large repos. Most jobs only need the last commit. Required only for tools like commitlint, semantic-release, lerna, or git log analysis.

What you can do

If you maintain webpack/webpack or a similar workflow shape, three patterns probably move the most dollars per minute of work:

Add a concurrency: block with cancel-in-progress: true on every PR-triggered workflow.
Set timeout-minutes on every job (default is 6 hours).
Make sure every setup-* action sets cache: <ecosystem>.

Free CLIs that automate the audit and the pin step:

npx ci-doctor             # 14-rule audit
npx ci-doctor --fix       # auto-apply the four safe fixes
npx pin-actions           # pin every uses: ref to a SHA
npx gha-budget            # estimate per-run $ + monthly

About this dataset