GitHub Actions Cancel Waste Audit

Audit cancelled and timed-out GitHub Actions runs from JSON exports to surface wasted CI minutes and noisy workflows.

Security Scan

The skill's code and instructions match its stated purpose (auditing cancelled/timed-out GitHub Actions runs from local JSON exports); there are no hidden network calls or credential requests and the footprint is small.

Purpose & Capability

Name/description align with the included script and fixtures. One minor mismatch: SKILL.md shows using `gh api` to collect run JSONs (which requires the GitHub CLI and authentication), but the skill's declared required binaries list only `bash` and `python3`. The audit itself operates on local JSON files and does not call out to GitHub at runtime.

Instruction Scope

Runtime instructions and the script operate only on local JSON files matched by RUN_GLOB, apply regex filters, compute durations, and emit text or JSON reports. The script does not read unrelated system files, access external endpoints, or reference undeclared environment secrets.

Install Mechanism

No install spec (instruction-only with a bundled script). Nothing is downloaded or installed by the skill itself.

Credentials

The skill requires no credentials or non-proportional environment access. It uses a number of optional environment variables to control filtering and thresholds; none are secret tokens.

Persistence & Privilege

Skill is not always-enabled and does not request persistent privileges or modify other skills or system-wide agent settings.

Assessment

This skill appears to do exactly what it claims: parse local GitHub Actions run JSON exports and report wasted CI minutes. Before installing or running it, consider: (1) SKILL.md suggests collecting run JSON via `gh api` — using that requires the GitHub CLI and authentication (not required by the script itself). (2) The script reads any files matched by RUN_GLOB, so ensure the glob only matches intended run-export files and not unrelated JSON containing secrets. (3) Run against the provided fixtures first (RUN_GLOB='skills/github-actions-cancel-waste-audit/fixtures/*.json') to verify behavior. (4) Review and, if desired, pin or sandbox where you run the script in case you feed it large or sensitive datasets.

Use this skill to quantify wasted GitHub Actions runtime from cancelled or timed-out runs so flaky workflow churn gets fixed before it burns CI budget.

What this skill does

• Reads one or more GitHub Actions run JSON exports (gh api output)
• Estimates wasted runtime minutes per run (run_started_at/created_at -> updated_at)
• Groups waste by repository + workflow + conclusion for fast triage
• Flags warn/critical waste levels using configurable minute thresholds
• Supports text and JSON output for terminal checks or dashboards

Inputs

Optional:

• RUN_GLOB (default: artifacts/github-actions-runs/*.json)
• TOP_N (default: 20)
• OUTPUT_FORMAT (text or json, default: text)
• WARN_WASTED_MINUTES (default: 15)
• CRITICAL_WASTED_MINUTES (default: 45)
• FAIL_ON_CRITICAL (0 or 1, default: 0)
• REPO_MATCH (regex, optional)
• REPO_EXCLUDE (regex, optional)
• WORKFLOW_MATCH (regex, optional)
• WORKFLOW_EXCLUDE (regex, optional)
• BRANCH_MATCH (regex, optional)
• BRANCH_EXCLUDE (regex, optional)
• ACTOR_MATCH (regex, optional)
• ACTOR_EXCLUDE (regex, optional)
• CONCLUSION_MATCH (regex, optional, default behavior already includes only cancelled/timed_out)
• CONCLUSION_EXCLUDE (regex, optional)

Collect run JSON

Single repository:

gh api repos/<owner>/<repo>/actions/runs --paginate \
  > artifacts/github-actions-runs/<owner>-<repo>.json

Run

Text report:

RUN_GLOB='artifacts/github-actions-runs/*.json' \
WARN_WASTED_MINUTES=20 \
CRITICAL_WASTED_MINUTES=60 \
bash skills/github-actions-cancel-waste-audit/scripts/cancel-waste-audit.sh

JSON output for automation:

RUN_GLOB='artifacts/github-actions-runs/*.json' \
OUTPUT_FORMAT=json \
FAIL_ON_CRITICAL=1 \
bash skills/github-actions-cancel-waste-audit/scripts/cancel-waste-audit.sh

Filter to one repo/workflow family:

RUN_GLOB='artifacts/github-actions-runs/*.json' \
REPO_MATCH='^flowcreatebot/' \
WORKFLOW_MATCH='(test|build)' \
BRANCH_MATCH='^(main|release)' \
bash skills/github-actions-cancel-waste-audit/scripts/cancel-waste-audit.sh

Run with bundled fixtures:

RUN_GLOB='skills/github-actions-cancel-waste-audit/fixtures/*.json' \
bash skills/github-actions-cancel-waste-audit/scripts/cancel-waste-audit.sh

Output contract

• Exit 0 in reporting mode (default)
• Exit 1 if FAIL_ON_CRITICAL=1 and at least one run has waste at/above CRITICAL_WASTED_MINUTES
• In text mode: prints summary and top waste hotspots
• In json mode: prints summary, grouped stats, and critical run instances