Github Actions Optimizer

Optimize GitHub Actions workflows for speed, cost, security, and reliability — analyze run times, cache strategies, job parallelism, and runner selection.

charlie-morrison@charlie-morrison

Install

openclaw skills install @charlie-morrison/github-actions-optimizer

GitHub Actions Optimizer

Analyze and optimize GitHub Actions workflows for faster builds, lower costs, better security, and higher reliability. Reviews workflow files, run history, cache usage, and runner configurations. Use when CI is slow, expensive, or unreliable.

Usage

text

"Optimize my GitHub Actions workflows"
"Why are my CI builds so slow?"
"Audit my workflows for security issues"
"Reduce GitHub Actions costs"
"Find flaky steps in my CI pipeline"

How It Works

1. Workflow Discovery

bash

# Find all workflow files
find .github/workflows -name "*.yml" -o -name "*.yaml" 2>/dev/null

# Check recent run durations
gh run list --limit 20 --json name,status,conclusion,startedAt,updatedAt,databaseId | python3 -c "
import json, sys
from datetime import datetime
runs = json.load(sys.stdin)
for r in runs:
    start = datetime.fromisoformat(r['startedAt'].rstrip('Z'))
    end = datetime.fromisoformat(r['updatedAt'].rstrip('Z'))
    duration = (end - start).total_seconds() / 60
    print(f'{r[\"name\"]:30s} {r[\"conclusion\"]:10s} {duration:.1f}min')
"

2. Speed Optimization

Caching analysis:

Are dependencies cached? (actions/cache or actions/setup-node with cache)
Cache hit rate from recent runs
Missing cache keys for build artifacts, Docker layers, compiled assets
Cache size approaching 10GB limit?
Stale cache keys never cleaned up

Job parallelism:

Sequential jobs that could run in parallel
Large matrix builds that could be split
Test suites that could be sharded
Independent steps within a single job

Runner optimization:

Self-hosted vs GitHub-hosted: cost/speed tradeoff
Larger runners available? (ubuntu-latest-xl, ubuntu-latest-16-cores)
ARM runners for compatible workloads (30% cheaper)
Container jobs vs VM jobs

Build optimization:

Unnecessary checkout of full git history (fetch-depth: 0)
Redundant install steps across jobs
Tests running on every push instead of just PRs
Docker builds without layer caching
Missing path filters (trigger on irrelevant file changes)

3. Cost Reduction

Minute savings:

Identify most expensive workflows (minutes × frequency)
Timeout missing on long-running jobs (default: 6 hours!)
Concurrency groups to cancel redundant runs
Path filtering to skip irrelevant triggers
PR-only vs push+PR triggers

Storage savings:

Artifact retention too long (default: 90 days)
Large artifacts uploaded unnecessarily
Cache entries never evicted

4. Security Audit

Pinned actions: Using @v3 instead of SHA pinning
Secrets exposure: Secrets passed to untrusted steps
GITHUB_TOKEN permissions: Overly broad default permissions
Pull request target: Workflow runs on pull_request_target with checkout of PR head
Script injection: Untrusted input in run: blocks (${{ github.event.issue.title }})
Third-party actions: Unverified marketplace actions with broad permissions
Environment protection: Missing required reviewers on production deployments

5. Reliability

Retry strategy: Flaky steps without retry configuration
Timeout values: Missing or too generous timeouts
Error handling: continue-on-error hiding real failures
Status checks: Required checks that aren't actually running
Concurrency: Race conditions between parallel workflow runs

6. Modern Patterns

Recommend modern GitHub Actions features:

Reusable workflows for DRY CI
Composite actions for shared steps
Environments with deployment protection rules
OIDC for cloud authentication (no long-lived secrets)
Merge queues for safe main branch

Output