Live $79 audit on two flagship public repos. Same deterministic engine. Zero LLM-in-the-loop. 2.2× asymmetry tells you what mature OSS still misses.
The analyzer is a deterministic static scan over .github/workflows/*.yml plus Dockerfiles, lockfiles, and reusable action definitions. It checks for 10 patterns that account for the bulk of recurring GitHub Actions overspend:
actions/cache on heavy dependency installs (node_modules, pip wheels, gradle, cargo). Single biggest leak — re-fetching deps every PR multiplies minutes by N runs.concurrency.cancel-in-progress: true. Push 5 quick commits to a PR? Without cancellation, you run the full test matrix 5 times. Cancel-in-progress reduces this to 1.actions/checkout with fetch-depth: 0 when shallow clone would work.setup-node 5 times in a workflow when setup could be shared).Each finding includes a confidence rating, a $/mo savings estimate calibrated to mid-volume workloads, and a before/after diff snippet paste-able into a PR. Zero LLM-in-the-loop — meaning 100% reproducible findings + zero hallucination risk.
Run: The audit ran against github.com/vercel/next.js, the React framework Vercel ships and maintains. This is widely considered one of the better-engineered OSS repos in the JS ecosystem — >100K stars, dozens of full-time maintainers, mature CI investment.
| Metric | Value |
|---|---|
| Total findings | 56 |
| Estimated recurring savings | $8,215/mo |
| Annualized | ~$98,580/yr |
| Severity mix | ~30 CRITICAL · ~20 HIGH · ~6 MEDIUM |
Top finding categories: missing actions/cache on several workflow files (Next.js has many workflows for the docs site, the framework, the test matrix), matrix bloat on browser-compat tests, and cancel-in-progress missing on the docs-deploy workflow. None of these are "bugs" in a strict sense — they're cost-leak patterns that built up over years of organic workflow growth.
See the full report:
→ View live audit output for vercel/next.js (HTML, ~28KB)Run: Same audit, against github.com/huggingface/transformers. The flagship Python ML library, 100K+ stars, deep CI investment because every PR runs significant test suites.
| Metric | Value |
|---|---|
| Total findings | 122 |
| Estimated recurring savings | $17,055/mo |
| Annualized | ~$204,660/yr |
| Severity mix | ~70 CRITICAL · ~40 HIGH · ~12 MEDIUM |
Transformers has roughly 2.2× more findings + 2.1× more $/mo than Next.js. Why? Heavier dependency installs (PyTorch, TensorFlow, JAX optionals), more matrix dimensions (Python version × backend × hardware target), longer-running test suites that benefit more from cache-on-warm, and Docker buildx steps that would dramatically benefit from cache-from/cache-to backend.
See the full report:
→ View live audit output for huggingface/transformers (HTML, ~52KB)The point of running on TWO public repos isn't to dunk on either project. Both Next.js and Transformers are excellent. The point is engine-honesty:
This is the same honesty-proof pattern I use across all my audit products (LLM Bill X-Ray, Stripe Webhook Audit, Anthropic Prompt Library Audit, AWS NAT Gateway Audit, Datadog Static Cost Audit, this one). Run on a reference-quality repo + a production repo, compare the contrast, let the customer judge.
The audit ranks findings by $/mo descending. For a typical repo, the top 3 fixes are:
actions/cache on the heaviest dependency install (usually node_modules or pip). Single-finding savings: $400-$1,200/mo depending on PR volume.concurrency.cancel-in-progress: true at the top of every workflow that runs on push/PR. 1-line change × dozens of workflows = $200-$800/mo.cache-from: type=gha, cache-to: type=gha,mode=max. $100-$500/mo per Dockerfile that gets built often.None of these require architectural changes. They're configuration tweaks that compound across every PR run for the lifetime of the repo.
Every $79 GitHub Actions Cost Audit includes a re-audit voucher: 30 days after delivery, you submit the same repo URL, the analyzer re-runs, and you see which findings closed. If your billing console doesn't show the projected savings landing, refund. The math is verifiable in your next GitHub billing cycle.
Drop a GitHub repo URL. Get a personalized HTML report within 1 hour with $/mo-ranked findings + before/after diffs you can paste into a PR.
Buy GitHub Actions Cost Audit — $79 → Or view the vercel/next.js sample report first