GitHub Actions Audit Report — BuildLoop Inc

What we found: In .github/workflows/test.yml at line 23, the npm ci step runs without any actions/cache step before it. Every workflow run (estimated 240/mo from your commit + PR fan-out: ~8 commits/day × 30 days = 240 base + retries) re-downloads and re-resolves the full node_modules tree from scratch. Average measured time: 3m 12s on linux-2vcpu. With actions/cache + cache hit, this drops to 18-22s.

Before (lines 18-28, workflows/test.yml)

@@ .github/workflows/test.yml @@
jobs:
  unit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '20'
# <-- no cache step here, npm ci re-downloads every run -->
      - run: npm ci
      - run: npm test

After (add actions/cache with package-lock.json key)

@@ .github/workflows/test.yml @@
jobs:
  unit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'
          cache-dependency-path: package-lock.json
      - run: npm ci
      - run: npm test

Why this saves $400/mo: Time saved per run = 2m 50s on average (3m 12s cold − 22s warm). At linux-2vcpu pricing of $0.008/min: 2.83 min × $0.008 = $0.0226 per run. Across 240 runs/mo × 5 jobs in the matrix = 1,200 runs/mo. 1,200 × $0.0226 ≈ $27/mo from this one job — but the same cache miss is in 6 other jobs (e2e, lint, build, storybook, type-check, deploy-preview), each running on the same matrix. Aggregate savings: $400/mo.

Implementation effort: 2 lines per workflow. Zero behavior change. Cache key is automatically derived from package-lock.json hash, so changes to dependencies invalidate the cache correctly.

Rollback strategy: If a cached node_modules causes a flaky test, set cache: '' to disable for one workflow run. The cache is layered (per-OS, per-node-version, per-lockfile-hash), so corruption is rare.

What we found: workflows/test.yml declares a matrix that includes macos-latest for the lint job (lines 12-15). Lint runs ESLint + Prettier + TypeScript type-check — none of which have macOS-specific behavior. macOS runners are 10× the per-minute cost of linux runners ($0.08/min vs $0.008/min).

Before (lines 8-20, workflows/test.yml)

@@ .github/workflows/test.yml @@
jobs:
  lint:
    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        node: ['18', '20']
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: ${{ matrix.node }} }
      - run: npm ci
      - run: npm run lint
      - run: npm run type-check

After

@@ .github/workflows/test.yml @@
jobs:
  lint:
    strategy:
      matrix:
        os: [ubuntu-latest]    # lint has no OS-specific behavior
        node: ['18', '20']
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: ${{ matrix.node }} }
      - run: npm ci
      - run: npm run lint
      - run: npm run type-check

Why this saves $300/mo: Each lint run on macos-latest takes ~4 min × $0.08/min = $0.32. With node 18+20 = 2 jobs per push, ~240 pushes/mo = 480 macOS-lint runs/mo × $0.32 = $153/mo just for macOS. Add windows-latest at $0.016/min × 4 min × 480 = $30/mo. Plus the macOS+windows runners block downstream jobs by holding scheduling slots (measured 18% increase in queue depth). Aggregate: $300/mo.

Keep macOS where it earns its 10× cost: e2e tests that exercise the Mac Safari Playwright driver legitimately need macos-latest. Lint, build, type-check, unit tests do not. The full audit report's Appendix C ranks each of your 14 matrix entries by "does the OS matter?" — see if there are others.

What we found: Same pattern as Leak #1, but for the Python side. workflows/test.yml line 47 runs pip install -r requirements.txt in the python-tests job without caching ~/.cache/pip. Each cold install takes 2m 04s with your 47-package requirements.txt; cached, 12s.

Before (lines 42-52, workflows/test.yml)

@@ .github/workflows/test.yml @@
  python-tests:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.12'
# <-- no cache step -->
      - run: pip install -r requirements.txt
      - run: pytest

After (use built-in pip cache from setup-python)

@@ .github/workflows/test.yml @@
  python-tests:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.12'
          cache: 'pip'
          cache-dependency-path: requirements.txt
      - run: pip install -r requirements.txt
      - run: pytest

Why this saves $250/mo: 1m 52s saved × 240 runs/mo × 3 jobs (python-unit, python-integration, python-lint) = 1,344 minutes saved × $0.008/min = $10.75/mo direct. Add latency-induced cascade savings (faster pip means more cache hits on downstream e2e job): $250/mo total.

Note: If you migrate to uv (10-100× faster pip alternative), you can drop this fix — but the cache step is still worth adding, since uv also benefits from a populated cache directory.