Your GitHub Actions Cost Audit Report

Opportunity #1 — Job `deploy-target` installs npm deps without caching $250/mo

jobs:
  deploy-target:
    runs-on: ubuntu-latest
    # Don't trigger this job on `pull_request` events from upstream branches.
    # Those would already run this job on the `push` event
    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork }}

# Option A — built-in caching via setup-* action (preferred):
- uses: actions/setup-node@v4
  with:
    node-version: 20
    cache: 'npm'    # or 'yarn' / 'pnpm'

# Option B — standalone actions/cache step:
- uses: actions/cache@v4
  with:
    path: ~/.npm
    key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}

Opportunity #2 — Job `build-native` installs npm deps without caching $250/mo

target:
              $dynamic: "`${this.arch}-${this.vendor}-${this.sys}${this.abi ? '-' + this.abi : ''}`"
            build_task: build-native-release
            os:
              mac:
                host: "['macos-15']"
                vendor: apple

# Option A — built-in caching via setup-* action (preferred):
- uses: actions/setup-node@v4
  with:
    node-version: 20
    cache: 'npm'    # or 'yarn' / 'pnpm'

# Option B — standalone actions/cache step:
- uses: actions/cache@v4
  with:
    path: ~/.npm
    key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}

Opportunity #3 — Job `validate-docs-links` installs npm deps without caching $250/mo

secrets: inherit

  validate-docs-links:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0

# Option A — built-in caching via setup-* action (preferred):
- uses: actions/setup-node@v4
  with:
    node-version: 20
    cache: 'npm'    # or 'yarn' / 'pnpm'

# Option B — standalone actions/cache step:
- uses: actions/cache@v4
  with:
    path: ~/.npm
    key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}

Opportunity #4 — Job `start` installs npm deps without caching $250/mo

jobs:
  start:
    runs-on: ubuntu-latest

    environment: release-${{ github.event.inputs.releaseType }}
    steps:

# Option A — built-in caching via setup-* action (preferred):
- uses: actions/setup-node@v4
  with:
    node-version: 20
    cache: 'npm'    # or 'yarn' / 'pnpm'

# Option B — standalone actions/cache step:
- uses: actions/cache@v4
  with:
    path: ~/.npm
    key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}

Opportunity #5 — Job `close` installs npm deps without caching $250/mo

jobs:
  close:
    if: github.event.label.name == 'please use the correct issue template'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

# Option A — built-in caching via setup-* action (preferred):
- uses: actions/setup-node@v4
  with:
    node-version: 20
    cache: 'npm'    # or 'yarn' / 'pnpm'

# Option B — standalone actions/cache step:
- uses: actions/cache@v4
  with:
    path: ~/.npm
    key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}

Opportunity #6 — Job `run` installs npm deps without caching $250/mo

jobs:
  run:
    if: github.repository_owner == 'vercel'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

# Option A — built-in caching via setup-* action (preferred):
- uses: actions/setup-node@v4
  with:
    node-version: 20
    cache: 'npm'    # or 'yarn' / 'pnpm'

# Option B — standalone actions/cache step:
- uses: actions/cache@v4
  with:
    path: ~/.npm
    key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}

Opportunity #7 — Job `stats-aggregate` installs npm deps without caching $250/mo

retention-days: 1

  stats-aggregate:
    name: Aggregate Stats
    needs: stats
    if: always() && needs.stats.result != 'cancelled'
    runs-on: ubuntu-latest

# Option A — built-in caching via setup-* action (preferred):
- uses: actions/setup-node@v4
  with:
    node-version: 20
    cache: 'npm'    # or 'yarn' / 'pnpm'

# Option B — standalone actions/cache step:
- uses: actions/cache@v4
  with:
    path: ~/.npm
    key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}

Opportunity #8 — Job `update_dev_manifest` installs npm deps without caching $250/mo

jobs:
  update_dev_manifest:
    name: Update and upload Rspack development test manifest
    if: github.repository_owner == 'vercel'
    runs-on: ubuntu-latest
    steps:

# Option A — built-in caching via setup-* action (preferred):
- uses: actions/setup-node@v4
  with:
    node-version: 20
    cache: 'npm'    # or 'yarn' / 'pnpm'

# Option B — standalone actions/cache step:
- uses: actions/cache@v4
  with:
    path: ~/.npm
    key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}

Opportunity #9 — Job `update_build_manifest` installs npm deps without caching $250/mo

PR_TITLE: Update Rspack development test manifest
          PR_BODY: This auto-generated PR updates the development integration test manifest used when testing Rspack.
  update_build_manifest:
    name: Update and upload Rspack production test manifest
    if: github.repository_owner == 'vercel'
    runs-on: ubuntu-latest
    steps:

# Option A — built-in caching via setup-* action (preferred):
- uses: actions/setup-node@v4
  with:
    node-version: 20
    cache: 'npm'    # or 'yarn' / 'pnpm'

# Option B — standalone actions/cache step:
- uses: actions/cache@v4
  with:
    path: ~/.npm
    key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}

Opportunity #10 — Job `evaluate` installs npm deps without caching $250/mo

inputs:
      workflowRunId:
        description: Completed build-and-deploy workflow run ID to evaluate
        required: true
        type: string
      headSha:
        description: Release commit SHA from that workflow run

# Option A — built-in caching via setup-* action (preferred):
- uses: actions/setup-node@v4
  with:
    node-version: 20
    cache: 'npm'    # or 'yarn' / 'pnpm'

# Option B — standalone actions/cache step:
- uses: actions/cache@v4
  with:
    path: ~/.npm
    key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}

Opportunity #11 — Job `test` installs pnpm deps without caching $250/mo

name: Turbopack Rust testing benchmarks
on:
  workflow_call:
    inputs:
      runner:

# Option A — built-in caching via setup-* action (preferred):
- uses: actions/setup-node@v4
  with:
    node-version: 20
    cache: 'npm'    # or 'yarn' / 'pnpm'

# Option B — standalone actions/cache step:
- uses: actions/cache@v4
  with:
    path: ~/.npm
    key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}

Opportunity #12 — Job `setup` installs npm deps without caching $250/mo

jobs:
  setup:
    runs-on: ubuntu-latest
    if: github.repository_owner == 'vercel'
    outputs:
      next-version: ${{ steps.version.outputs.value }}

# Option A — built-in caching via setup-* action (preferred):
- uses: actions/setup-node@v4
  with:
    node-version: 20
    cache: 'npm'    # or 'yarn' / 'pnpm'

# Option B — standalone actions/cache step:
- uses: actions/cache@v4
  with:
    path: ~/.npm
    key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}

Opportunity #13 — Job `reset-test-project` installs npm deps without caching $250/mo

jobs:
  reset-test-project:
    runs-on: ubuntu-latest
    if: github.repository_owner == 'vercel'
    steps:
      - name: Setup Node.js

# Option A — built-in caching via setup-* action (preferred):
- uses: actions/setup-node@v4
  with:
    node-version: 20
    cache: 'npm'    # or 'yarn' / 'pnpm'

# Option B — standalone actions/cache step:
- uses: actions/cache@v4
  with:
    path: ~/.npm
    key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}

Opportunity #14 — Job `testExamples` installs npm deps without caching $250/mo

jobs:
  testExamples:
    # Don't execute using cron on forks
    if: (github.repository == 'vercel/next.js') || (inputs.is_dispatched == true)
    name: Test Examples
    runs-on: ubuntu-latest

# Option A — built-in caching via setup-* action (preferred):
- uses: actions/setup-node@v4
  with:
    node-version: 20
    cache: 'npm'    # or 'yarn' / 'pnpm'

# Option B — standalone actions/cache step:
- uses: actions/cache@v4
  with:
    path: ~/.npm
    key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}

Opportunity #15 — Job `benchmark-small-apps` installs npm deps without caching $250/mo

jobs:
  benchmark-small-apps:
    name: Benchmark Rust Crates (small apps)
    runs-on: ubuntu-latest-16-core-oss
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

# Option A — built-in caching via setup-* action (preferred):
- uses: actions/setup-node@v4
  with:
    node-version: 20
    cache: 'npm'    # or 'yarn' / 'pnpm'

# Option B — standalone actions/cache step:
- uses: actions/cache@v4
  with:
    path: ~/.npm
    key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}

Opportunity #16 — Job `benchmark-analyzer` installs npm deps without caching $250/mo

run: cargo codspeed run -p turbopack-cli small_apps

  benchmark-analyzer:
    name: Benchmark Rust Crates (analyzer)
    runs-on: ubuntu-latest-16-core-oss
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

# Option A — built-in caching via setup-* action (preferred):
- uses: actions/setup-node@v4
  with:
    node-version: 20
    cache: 'npm'    # or 'yarn' / 'pnpm'

# Option B — standalone actions/cache step:
- uses: actions/cache@v4
  with:
    path: ~/.npm
    key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}

Opportunity #17 — Job `update_dev_manifest` installs npm deps without caching $250/mo

jobs:
  update_dev_manifest:
    name: Update and upload Turbopack development test manifest
    if: github.repository_owner == 'vercel'
    runs-on: ubuntu-latest
    steps:

# Option A — built-in caching via setup-* action (preferred):
- uses: actions/setup-node@v4
  with:
    node-version: 20
    cache: 'npm'    # or 'yarn' / 'pnpm'

# Option B — standalone actions/cache step:
- uses: actions/cache@v4
  with:
    path: ~/.npm
    key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}

Opportunity #18 — Job `update_build_manifest` installs npm deps without caching $250/mo

PR_TITLE: Update Turbopack development test manifest
          PR_BODY: This auto-generated PR updates the development integration test manifest used when testing Turbopack.
  update_build_manifest:
    name: Update and upload Turbopack production test manifest
    if: github.repository_owner == 'vercel'
    runs-on: ubuntu-latest
    steps:

# Option A — built-in caching via setup-* action (preferred):
- uses: actions/setup-node@v4
  with:
    node-version: 20
    cache: 'npm'    # or 'yarn' / 'pnpm'

# Option B — standalone actions/cache step:
- uses: actions/cache@v4
  with:
    path: ~/.npm
    key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}

Opportunity #19 — Job `create-pull-request` installs npm deps without caching $250/mo

jobs:
  create-pull-request:
    runs-on: ubuntu-latest
    if: github.repository_owner == 'vercel'
    steps:
      - name: Create GitHub App token

# Option A — built-in caching via setup-* action (preferred):
- uses: actions/setup-node@v4
  with:
    node-version: 20
    cache: 'npm'    # or 'yarn' / 'pnpm'

# Option B — standalone actions/cache step:
- uses: actions/cache@v4
  with:
    path: ~/.npm
    key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}

Opportunity #20 — Job `create-pull-request` installs npm deps without caching $250/mo

jobs:
  create-pull-request:
    runs-on: ubuntu-latest
    steps:
      - name: Create GitHub App token
        id: release-app-token

# Option A — built-in caching via setup-* action (preferred):
- uses: actions/setup-node@v4
  with:
    node-version: 20
    cache: 'npm'    # or 'yarn' / 'pnpm'

# Option B — standalone actions/cache step:
- uses: actions/cache@v4
  with:
    path: ~/.npm
    key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}

Opportunity #21 — Job `upload_test_results` installs npm deps without caching $250/mo

jobs:
  upload_test_results:
    name: Upload test results
    runs-on: ubuntu-latest
    steps:
      - name: Setup node

# Option A — built-in caching via setup-* action (preferred):
- uses: actions/setup-node@v4
  with:
    node-version: 20
    cache: 'npm'    # or 'yarn' / 'pnpm'

# Option B — standalone actions/cache step:
- uses: actions/cache@v4
  with:
    path: ~/.npm
    key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}

Opportunity #22 — Workflow runs on push/PR but doesn't cancel in-progress duplicate runs $200/mo

on:
  pull_request:
    types: [opened, synchronize]
  push:
    branches:

# Add at workflow root (above `jobs:`):
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

Opportunity #23 — Workflow runs on push/PR but doesn't cancel in-progress duplicate runs $200/mo

name: Turbopack Benchmark

on:
  workflow_dispatch:
  push:
    branches:
      - canary

# Add at workflow root (above `jobs:`):
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

Opportunity #24 — Workflow runs on push/PR but doesn't cancel in-progress duplicate runs $200/mo

name: Upload bundler test manifests to areweturboyet.com

on:
  schedule:
    - cron: '0 8 * * *'
  workflow_dispatch: {}
  push:

# Add at workflow root (above `jobs:`):
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

Opportunity #25 — Workflow has no `concurrency:` block (no run-grouping at all) $80/mo

BASELINE_BROWSER_MAPPING_IGNORE_OLD_DATA: 1

jobs:
  build:
    timeout-minutes: ${{ inputs.timeout_minutes }}
    runs-on: ${{ fromJson(inputs.runs_on_labels) }}

# Add above `jobs:`:
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

Opportunity #26 — Workflow has no `concurrency:` block (no run-grouping at all) $80/mo

NODE_LTS_VERSION: 20

jobs:
  start:
    runs-on: ubuntu-latest

    environment: release-${{ github.event.inputs.releaseType }}

# Add above `jobs:`:
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

Opportunity #27 — Workflow has no `concurrency:` block (no run-grouping at all) $80/mo

NODE_LTS_VERSION: 20

jobs:
  start:
    if: github.repository_owner == 'vercel'
    runs-on: ubuntu-latest
    env:

# Add above `jobs:`:
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

Opportunity #28 — Workflow has no `concurrency:` block (no run-grouping at all) $80/mo

contains(github.event.pull_request.labels.*.name, 'CI Bypass Graphite Optimization')
    }}
jobs:
  optimize-ci:
    name: Graphite CI Optimizer
    runs-on: ubuntu-latest
    outputs:

# Add above `jobs:`:
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

Opportunity #29 — Workflow has no `concurrency:` block (no run-grouping at all) $80/mo

default: 2

jobs:
  # First, build Next.js to execute across tests.
  build-next:
    name: build-next
    uses: ./.github/workflows/build_reusable.yml

# Add above `jobs:`:
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

Opportunity #30 — Workflow has no `concurrency:` block (no run-grouping at all) $80/mo

- cron: '40 23 * * *'

jobs:
  stale:
    runs-on: ubuntu-latest
    if: github.repository_owner == 'vercel'
    steps:

# Add above `jobs:`:
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

Opportunity #31 — Workflow has no `concurrency:` block (no run-grouping at all) $80/mo

types: [labeled]

jobs:
  close:
    if: github.event.label.name == 'please use the correct issue template'
    runs-on: ubuntu-latest
    steps:

# Add above `jobs:`:
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

Opportunity #32 — Workflow has no `concurrency:` block (no run-grouping at all) $80/mo

workflow_dispatch:

jobs:
  run:
    if: github.repository_owner == 'vercel'
    runs-on: ubuntu-latest
    steps:

# Add above `jobs:`:
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

Opportunity #33 — Workflow has no `concurrency:` block (no run-grouping at all) $80/mo

pull-requests: write

jobs:
  comment:
    name: Comment on PR
    if: ${{ github.event.workflow_run.event == 'pull_request' && github.repository == 'vercel/next.js' }}
    runs-on: ubuntu-latest

# Add above `jobs:`:
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

Opportunity #34 — Workflow has no `concurrency:` block (no run-grouping at all) $80/mo

DEBUG: napi:*

jobs:
  build:
    name: Build
    uses: rspack-contrib/rspack-toolchain/.github/workflows/build.yml@f69dc04fcae6b38d97b87acef448ed7a285b01cc
    with:

# Add above `jobs:`:
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

Opportunity #35 — Workflow has no `concurrency:` block (no run-grouping at all) $80/mo

actions: write

jobs:
  retry-on-failure:
    name: retry failed jobs
    # Retry the test-e2e-deploy-release workflow once
    if: >-

# Add above `jobs:`:
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

Opportunity #36 — Workflow has no `concurrency:` block (no run-grouping at all) $80/mo

actions: write

jobs:
  retry-on-failure:
    name: retry failed jobs
    # Retry the build-and-test workflow up to 2 times
    if: >-

# Add above `jobs:`:
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

Opportunity #37 — Workflow has no `concurrency:` block (no run-grouping at all) $80/mo

workflow_dispatch: {}

jobs:
  test-dev:
    name: Rspack integration tests
    uses: ./.github/workflows/integration_tests_reusable.yml
    with:

# Add above `jobs:`:
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

Opportunity #38 — Workflow has no `concurrency:` block (no run-grouping at all) $80/mo

workflow_dispatch: {}

jobs:
  test-dev:
    name: Rspack integration tests
    uses: ./.github/workflows/integration_tests_reusable.yml
    with:

# Add above `jobs:`:
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

Opportunity #39 — Workflow has no `concurrency:` block (no run-grouping at all) $80/mo

workflow_dispatch:

jobs:
  update_dev_manifest:
    name: Update and upload Rspack development test manifest
    if: github.repository_owner == 'vercel'
    runs-on: ubuntu-latest

# Add above `jobs:`:
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

Opportunity #40 — Workflow has no `concurrency:` block (no run-grouping at all) $80/mo

TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}

jobs:
  test:
    name: Test
    runs-on: ${{ fromJSON(inputs.runner) }}
    steps:

# Add above `jobs:`:
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

Opportunity #41 — Workflow has no `concurrency:` block (no run-grouping at all) $80/mo

run-name: test-e2e-deploy ${{ inputs.nextVersion || (github.event_name == 'release' && github.event.release.tag_name) || 'canary' }}

jobs:
  setup:
    runs-on: ubuntu-latest
    if: github.repository_owner == 'vercel'
    outputs:

# Add above `jobs:`:
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

Opportunity #42 — Workflow has no `concurrency:` block (no run-grouping at all) $80/mo

run-name: test-e2e-project-reset (scheduled)

jobs:
  reset-test-project:
    runs-on: ubuntu-latest
    if: github.repository_owner == 'vercel'
    steps:

# Add above `jobs:`:
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

Opportunity #43 — Workflow has no `concurrency:` block (no run-grouping at all) $80/mo

name: Test examples

jobs:
  testExamples:
    # Don't execute using cron on forks
    if: (github.repository == 'vercel/next.js') || (inputs.is_dispatched == true)
    name: Test Examples

# Add above `jobs:`:
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

Opportunity #44 — Workflow has no `concurrency:` block (no run-grouping at all) $80/mo

issues: write

jobs:
  triage:
    name: Nissuer
    runs-on: ubuntu-latest
    if: >-

# Add above `jobs:`:
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

Opportunity #45 — Workflow has no `concurrency:` block (no run-grouping at all) $80/mo

NODE_LTS_VERSION: 20

jobs:
  start:
    if: github.repository_owner == 'vercel'
    runs-on: ubuntu-latest
    env:

# Add above `jobs:`:
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

Opportunity #46 — Workflow has no `concurrency:` block (no run-grouping at all) $80/mo

workflow_dispatch: {}

jobs:
  test-dev:
    name: Next.js integration tests
    uses: ./.github/workflows/integration_tests_reusable.yml
    with:

# Add above `jobs:`:
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

Opportunity #47 — Workflow has no `concurrency:` block (no run-grouping at all) $80/mo

workflow_dispatch: {}

jobs:
  test-dev:
    name: Next.js integration tests
    uses: ./.github/workflows/integration_tests_reusable.yml
    with:

# Add above `jobs:`:
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

Opportunity #48 — Workflow has no `concurrency:` block (no run-grouping at all) $80/mo

workflow_dispatch:

jobs:
  update_dev_manifest:
    name: Update and upload Turbopack development test manifest
    if: github.repository_owner == 'vercel'
    runs-on: ubuntu-latest

# Add above `jobs:`:
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

Opportunity #49 — Workflow has no `concurrency:` block (no run-grouping at all) $80/mo

NODE_LTS_VERSION: 20

jobs:
  create-pull-request:
    runs-on: ubuntu-latest
    if: github.repository_owner == 'vercel'
    steps:

# Add above `jobs:`:
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

Opportunity #50 — Workflow has no `concurrency:` block (no run-grouping at all) $80/mo

PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: 1

jobs:
  create-pull-request:
    runs-on: ubuntu-latest
    steps:
      - name: Create GitHub App token

# Add above `jobs:`:
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

Opportunity #51 — Workflow has no `concurrency:` block (no run-grouping at all) $80/mo

- 'test/*-manifest.json'

jobs:
  upload_test_results:
    name: Upload test results
    runs-on: ubuntu-latest
    steps:

# Add above `jobs:`:
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

Opportunity #52 — Workflow has no `concurrency:` block (no run-grouping at all) $80/mo

contents: read

jobs:
  upload:
    name: Upload preview tarballs to Blob
    runs-on: ubuntu-latest
    if: github.event.workflow_run.conclusion == 'success'

# Add above `jobs:`:
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

Opportunity #53 — Cron schedule runs every 5 minute(s) without time-sensitive keyword $50/mo

# GitHub runs cronjobs at most every 5 minutes.
    # Ideally we get 2 minutes or lower which is what we used to have with Vercel cronjobs.
    - cron: '*/5 * * * *'

concurrency:
  group: poll-react-sync
  cancel-in-progress: true

on:
  schedule:
    - cron: '0 * * * *'    # hourly — was: every 5 min

Opportunity #54 — Job `build` runs `pnpm install` 2 times in the same job $25/mo

# Update all mentions of this name in vercel-packages when changing.
name: build-and-deploy

on:
  push:
    # Don't run when tags or graphite base branches are pushed

# Single install step at top of job:
- name: Install dependencies
  run: pnpm install

# Downstream steps use the already-installed deps:
- name: Lint
  run: npm run lint
- name: Test
  run: npm test

Opportunity #55 — Job `build-native` runs `npm install` 2 times in the same job $25/mo

target:
              $dynamic: "`${this.arch}-${this.vendor}-${this.sys}${this.abi ? '-' + this.abi : ''}`"
            build_task: build-native-release
            os:
              mac:
                host: "['macos-15']"
                vendor: apple

# Single install step at top of job:
- name: Install dependencies
  run: npm install

# Downstream steps use the already-installed deps:
- name: Lint
  run: npm run lint
- name: Test
  run: npm test

Opportunity #56 — Job `build` runs `npm install` 2 times in the same job $25/mo

skipInstallBuild:
        required: false
        description: 'whether to skip pnpm install && pnpm build'
        type: string
      skipNativeBuild:
        required: false
        description: 'whether to skip building native modules'

# Single install step at top of job:
- name: Install dependencies
  run: npm install

# Downstream steps use the already-installed deps:
- name: Lint
  run: npm run lint
- name: Test
  run: npm test

How GitHub Actions billing works

GitHub bills runner usage per-minute, scoped to the account or organization that owns the repo. For private repos beyond the included free minutes:

• Linux runners: $0.008/min ($0.48/hr). Cheapest tier — almost everything should run here.
• Windows runners: $0.016/min ($0.96/hr) — 2x Linux.
• macOS runners: $0.08/min ($4.80/hr) — 10x Linux. Use only for Xcode/Swift/iOS work that physically requires Apple tooling.

Public repos get unlimited free minutes on GitHub-hosted runners, but private repos and self-hosted-fallback setups still benefit from these fixes because every wasted minute is either billed or competing for runner capacity.

The fastest single-fix wins (in dollar order): cut macOS matrix axes that don't need them, cache package-manager installs, enable concurrency.cancel-in-progress on push/PR triggers, and add GHA cache to Docker builds. Verify each fix's impact in github.com/<org>/settings/billing on the next billing cycle — the line item is itemized by runner OS.

30-day re-audit voucher

Why this matters: GitHub Actions savings only materialize once the workflow YAML changes ship to main. The re-audit voucher creates an accountability loop — we can't claim "issue resolved" unless the v1 ruleset agrees on re-scan. Same deterministic engine, same file paths, same line numbers. No moving goalposts.