kensaurus/cursor-kenji/audit-cicd

CI/CD Audit Skill

Degree of freedom: MIXED — Steps 1–3 judgment [HIGH freedom]; Step 0 gh inventory and Step 4 deletes [LOW freedom — run exactly].

Systematic audit of GitHub Actions workflows to cut the Actions bill (minutes + storage) and speed up CI without losing test coverage or deploy safety. Uses the gh CLI for live billing, run history, and storage data.

This skill vs neighbors

How to reason

1. Observe — quote the trigger, runs-on, concurrency, or gh minute/storage number
2. Interpret — billed twice, doomed minutes, or a 10× runner on every push?
3. Classify — double-bill / no-concurrency / expensive-runner / doomed-job / storage / correct
4. Severity — by $ × safety; never score a cut that drops coverage

Worked example

Observe: build-mobile.yml runs-on: macos-15 on push: to every

branch; no if: gate; private repo.

Interpret: every push bills ~10× Ubuntu for an iOS job nobody requested.

Classify: expensive-runner on ordinary push.

Severity: Very high (~10×).

Finding: build-mobile.yml | macos on push | dispatch/tag-only | ~10×

Step 0: Inventory the account and pipelines [LOW freedom — run exactly]

Measure before optimizing. Only private repos consume the paid minute allowance; public repos get free minutes — don't spend effort there.

# Which repos actually cost money (private, active, recent pushes)?
gh repo list <owner> --limit 200 --json name,visibility,isArchived,pushedAt \
  --jq 'sort_by(.pushedAt)|reverse|.[]|select(.visibility=="PRIVATE" and .isArchived==false)|"\(.name)\t\(.pushedAt[0:10])"'
 
# Per repo: active workflows, run volume (last 14d), and runner types
gh api "repos/<owner>/<repo>/actions/workflows" --jq '.workflows[]|select(.state=="active")|.name'
gh run list --repo <owner>/<repo> --created ">=YYYY-MM-DD" --limit 200 --json databaseId --jq 'length'
 
# Storage (the other half of the bill)
gh api "repos/<owner>/<repo>/actions/artifacts" --paginate --jq '[.artifacts[]|select(.expired==false)|.size_in_bytes]|add'
gh api "repos/<owner>/<repo>/actions/cache/usage" --jq '.active_caches_size_in_bytes'

Rank repos by runs × runner-multiplier. A macos-* job counts ~10x a ubuntu job; *-large/bigger runners cost more than standard.

Step 1: Anti-pattern scan (per workflow) [HIGH freedom]

For each .github/workflows/*.yml, check for the recurring cost drivers:

• [ ] Double-billing triggers — the same jobs run on both push: [main]

and pull_request for main (every merge bills twice). PR gates verification; a separate deploy.yml handles main. If both are needed, guard per-job with if: github.event_name == '...'.

• [ ] Missing `concurrency` — no cancel-in-progress, so rapid pushes/PR

syncs stack full runs instead of superseding.

• [ ] Expensive runners on ordinary pushes — macos-* / *-large firing

on every push instead of workflow_dispatch or version tags only.

• [ ] No path filters — docs/config-only changes run the full heavy suite

(add paths: / paths-ignore:).

• [ ] Doomed jobs — a costly job (visual/e2e/Lighthouse) runs in parallel

with a cheap gate and keeps burning minutes after the gate fails (gate it with needs: [...]).

• [ ] Long/default artifact retention — upload-artifact without

retention-days keeps outputs 90 days; heavy reports uploaded on success (if: always()) instead of if: failure().

• [ ] Self-uploading SARIF pile-ups — e.g. gitleaks-action uploads a tiny

SARIF artifact every run for 90 days.

• [ ] Over-frequent crons — daily schedule: where weekly suffices.
• [ ] Redundant rebuilds — two jobs each run the same build instead of

building once and sharing via artifact (only when their build env is identical — see Safety).

Step 2: Cost levers (highest impact first) [HIGH freedom]

Step 3: Fix patterns [HIGH freedom]

# Concurrency — every workflow. CI/verification cancels superseded runs:
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
 
# Deploy/release: never cancel a live deploy. For combined verify-on-PR +
# deploy-on-push workflows, cancel PR churn only:
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

# Expensive runner: dispatch/tag-only, not every push
build-ios:
  runs-on: macos-15
  if: ${{ inputs.platform == 'ios' || startsWith(github.ref, 'refs/tags/') }}
  timeout-minutes: 60   # cap runaway 10x spend
 
# Lean artifacts
- uses: actions/upload-artifact@v4
  if: failure()
  with: { name: report, path: report/, retention-days: 3 }
 
# Stop the gitleaks SARIF pile-up
env: { GITLEAKS_ENABLE_UPLOAD_ARTIFACT: "false" }

Step 4: Storage cleanup (destructive — confirm first) [LOW freedom — confirm first]

Artifacts and caches are ephemeral CI outputs; deleting them is safe but irreversible. Confirm with the user, then:

# Delete non-expired artifacts in a repo
gh api "repos/<owner>/<repo>/actions/artifacts" --paginate \
  --jq '.artifacts[]|select(.expired==false)|.id' \
| xargs -I{} gh api -X DELETE "repos/<owner>/<repo>/actions/artifacts/{}"
 
# Delete caches
gh api "repos/<owner>/<repo>/actions/caches" --paginate --jq '.actions_caches[].id' \
| xargs -I{} gh api -X DELETE "repos/<owner>/<repo>/actions/caches/{}"

Safety rules (do NOT trade coverage or deploys for cost)

• Never delete, skip, or weaken a test to save minutes. Make advisory

scans (npm audit, CVE scans) continue-on-error or move them to a schedule — keep the check.

• Keep the deploy gate. If deploy.yml triggers on the CI workflow_run

for push, do not remove the push trigger from CI.

• Only share a build across jobs when their build env is identical. Reusing

an artifact built with different secrets/flags (prod env, QA build stamps) ships or tests the wrong bundle.

• Update branch protection when renaming/merging jobs. If a required status

check's job name changes, PATCH required_status_checks.contexts in the same change or merges hang. Verify: gh api repos/<owner>/<repo>/branches/<main>/protection/required_status_checks --jq '.contexts'

• Verify with live runs. After pushing, confirm no startup_failure

(YAML parses) and that intended jobs skip/run: gh run view <id> --json jobs --jq '.jobs[]|"\(.conclusion // .status) \(.name)"'

Account backstops (one-time, GitHub UI)

UI-only at the time of writing — check whether the settings API now covers them before telling the user it is manual.

• Default artifact/log retention → Settings → Actions → General → drop from

90 days to ~14 (applies to all repos, including future ones).

• Spending budget → Settings → Billing → Budgets → set an Actions budget

with 75/90/100% alerts; keep "Stop usage" off so production deploys never hard-break.

• Rotate any secret leaked in a workflow/remote (the user must revoke;

you can only strip it from configs).

Self-critique before reporting [LOW freedom — do not skip]

1. Evidenced — workflow YAML or gh count, not "CI feels expensive"
2. Reproducible — same trigger/runs-on still present
3. Severity justified — ranked by $ × runner multiplier
4. Right owner — silent bypass / ratchet → audit-gate-logic; hosting bill → audit-infra-cost
5. No-false-safety — no test deleted or skipped to save minutes; storage delete confirmed

Output: CI/CD Cost Audit Report

## CI/CD Audit: [owner]
 
### Spend snapshot
-Actions billable: ~$X/mo (private repos exhaust the included minutes)
-Top spenders: [repo — ~$Y, driver], ...
-Storage: [X GB artifacts / Y GB caches]
 
### Findings (prioritized)
| # | Repo | Workflow | Anti-pattern | Fix | Impact |
|---|------|----------|--------------|-----|--------|
| 1 | repo | build-mobile.yml | macOS on every push | dispatch/tag-only | ~10x |
 
### Already healthy
-[repos/workflows already using concurrency, gated runners, path filters]
 
### Manual actions (user-only)
-[ ] Default artifact/log retention → 14 days
-[ ] Actions spending budget + alerts
-[ ] Rotate leaked secret(s), if any
 
### Expected outcome
~$A → ~$B/mo, no loss of test coverage or deploy safety.

Related

• audit-gate-logic — does the gate actually stop what it claims (bypass / ratchet)
• audit-infra-cost — hosting / DB / egress (not Actions minutes)
• test-visual-regression — screenshot CI artifact retention
• audit-security / deploy-verify / workflow-pr / create-hook