[
  {
    "id": "ci.cache.dependency-cache",
    "title": "Dependency caching",
    "category": "performance",
    "family": "best-practice",
    "url": "/best-practices/github-actions/cache-dependencies",
    "markdown": "/best-practices/github-actions/cache-dependencies.md",
    "patternIds": [
      "OPT61",
      "OPT63"
    ],
    "detectionMode": "static",
    "retired": false
  },
  {
    "id": "ci.checkout.shallow-clone",
    "title": "Shallow checkout",
    "category": "performance",
    "family": "best-practice",
    "url": "/best-practices/github-actions/shallow-checkout",
    "markdown": "/best-practices/github-actions/shallow-checkout.md",
    "patternIds": [
      "OPT28"
    ],
    "detectionMode": "static",
    "retired": false
  },
  {
    "id": "ci.parallel.test-sharding",
    "title": "Test sharding",
    "category": "performance",
    "family": "best-practice",
    "url": "/best-practices/github-actions/shard-tests",
    "markdown": "/best-practices/github-actions/shard-tests.md",
    "patternIds": [
      "OPT24"
    ],
    "detectionMode": "static",
    "retired": false
  },
  {
    "id": "ci.build.change-scoped",
    "title": "Change-scoped builds",
    "category": "performance",
    "family": "best-practice",
    "url": "/best-practices/github-actions/build-only-affected",
    "markdown": "/best-practices/github-actions/build-only-affected.md",
    "patternIds": [
      "OPT70"
    ],
    "detectionMode": "runtime",
    "retired": false
  },
  {
    "id": "ci.trigger.path-filter",
    "title": "Path filters",
    "category": "performance",
    "family": "best-practice",
    "url": "/best-practices/github-actions/path-filter-workflows",
    "markdown": "/best-practices/github-actions/path-filter-workflows.md",
    "patternIds": [
      "OPT32"
    ],
    "detectionMode": "static",
    "retired": false
  },
  {
    "id": "ci.trigger.cancel-superseded",
    "title": "Superseded runs cancelled",
    "category": "performance",
    "family": "best-practice",
    "url": "/best-practices/github-actions/cancel-superseded-runs",
    "markdown": "/best-practices/github-actions/cancel-superseded-runs.md",
    "patternIds": [
      "OPT45",
      "OPT46",
      "OPT44"
    ],
    "detectionMode": "hybrid",
    "retired": false
  },
  {
    "id": "ci.trigger.concurrency-groups",
    "title": "Concurrency groups",
    "category": "performance",
    "family": "best-practice",
    "url": "/best-practices/github-actions/cut-queue-time",
    "markdown": "/best-practices/github-actions/cut-queue-time.md",
    "patternIds": [
      "OPT43"
    ],
    "detectionMode": "runtime",
    "retired": false
  },
  {
    "id": "ci.hygiene.job-timeouts",
    "title": "Job timeouts",
    "category": "reliability",
    "family": "best-practice",
    "url": "/best-practices/github-actions/bound-job-timeouts",
    "markdown": "/best-practices/github-actions/bound-job-timeouts.md",
    "patternIds": [
      "OPT57"
    ],
    "detectionMode": "static",
    "retired": false
  },
  {
    "id": "ci.security.scoped-id-token",
    "title": "Scoped OIDC id-token",
    "category": "security",
    "family": "best-practice",
    "url": "/best-practices/github-actions/scope-id-token-per-job",
    "markdown": "/best-practices/github-actions/scope-id-token-per-job.md",
    "patternIds": [
      "P14.8"
    ],
    "detectionMode": "static",
    "retired": false
  },
  {
    "id": "ci.security.pinned-action-shas",
    "title": "Pinned action SHAs",
    "category": "security",
    "family": "best-practice",
    "url": "/best-practices/github-actions/pin-action-shas",
    "markdown": "/best-practices/github-actions/pin-action-shas.md",
    "patternIds": [
      "P5.1"
    ],
    "detectionMode": "static",
    "retired": false
  },
  {
    "id": "ci.hygiene.advisory-non-blocking",
    "title": "Advisory checks non-blocking",
    "category": "cost",
    "family": "best-practice",
    "url": "/best-practices/github-actions/keep-advisory-checks-non-blocking",
    "markdown": "/best-practices/github-actions/keep-advisory-checks-non-blocking.md",
    "patternIds": [
      "OPT71"
    ],
    "detectionMode": "runtime",
    "retired": false
  },
  {
    "id": "ci.runner.right-sizing",
    "title": "Right-sized runners",
    "category": "performance",
    "family": "best-practice",
    "url": "/best-practices/github-actions/right-size-runners",
    "markdown": "/best-practices/github-actions/right-size-runners.md",
    "patternIds": [
      "OPT66"
    ],
    "detectionMode": "runtime",
    "retired": false
  },
  {
    "id": "ci.hygiene.polling-waits",
    "title": "Polling waits, not fixed sleeps",
    "category": "performance",
    "family": "best-practice",
    "url": "/best-practices/github-actions/replace-fixed-sleeps-with-polling",
    "markdown": "/best-practices/github-actions/replace-fixed-sleeps-with-polling.md",
    "patternIds": [
      "OPT19"
    ],
    "detectionMode": "static",
    "retired": false
  },
  {
    "id": "ci.hygiene.container-healthchecks",
    "title": "Container healthchecks",
    "category": "reliability",
    "family": "best-practice",
    "url": "/best-practices/github-actions/wait-for-container-healthchecks",
    "markdown": "/best-practices/github-actions/wait-for-container-healthchecks.md",
    "patternIds": [
      "OPT17"
    ],
    "detectionMode": "static",
    "retired": false
  },
  {
    "id": "ci.security.workflow-permissions",
    "title": "Scoped workflow permissions",
    "category": "security",
    "family": "best-practice",
    "url": "/best-practices/github-actions/limit-github-actions-permissions",
    "markdown": "/best-practices/github-actions/limit-github-actions-permissions.md",
    "patternIds": [
      "P5.5",
      "P14.3"
    ],
    "detectionMode": "static",
    "retired": false
  },
  {
    "id": "ci.security.secret-handling",
    "title": "Secret handling",
    "category": "security",
    "family": "best-practice",
    "url": "/best-practices/github-actions/protect-github-actions-secrets",
    "markdown": "/best-practices/github-actions/protect-github-actions-secrets.md",
    "patternIds": [
      "P14.4",
      "P14.12",
      "P14.14",
      "P14.17",
      "P14.19",
      "P14.21",
      "P14.22"
    ],
    "detectionMode": "static",
    "retired": false
  },
  {
    "id": "ci.security.pull-request-target",
    "title": "pull_request_target safety",
    "category": "security",
    "family": "best-practice",
    "url": "/best-practices/github-actions/secure-pull-request-target",
    "markdown": "/best-practices/github-actions/secure-pull-request-target.md",
    "patternIds": [
      "P14.1",
      "P14.7",
      "P14.9",
      "P14.18"
    ],
    "detectionMode": "static",
    "retired": false
  },
  {
    "id": "ci.security.cache-isolation",
    "title": "Cache poisoning prevention",
    "category": "security",
    "family": "best-practice",
    "url": "/best-practices/github-actions/prevent-github-actions-cache-poisoning",
    "markdown": "/best-practices/github-actions/prevent-github-actions-cache-poisoning.md",
    "patternIds": [
      "P14.7",
      "P8.3"
    ],
    "detectionMode": "static",
    "retired": false
  },
  {
    "id": "ci.cache.turborepo",
    "title": "Turborepo cache health",
    "category": "performance",
    "family": "optimization",
    "url": "/github-actions/optimizations/optimize-turborepo",
    "markdown": "/github-actions/optimizations/optimize-turborepo.md",
    "patternIds": [
      "OPT3",
      "OPT41",
      "OPT42",
      "OPT52",
      "OPT53",
      "OPT58",
      "OPT59",
      "OPT60"
    ],
    "detectionMode": "static",
    "retired": false
  },
  {
    "id": "ci.cache.docker-layers",
    "title": "Docker layer caching",
    "category": "performance",
    "family": "optimization",
    "url": "/github-actions/optimizations/use-docker-layer-caching",
    "markdown": "/github-actions/optimizations/use-docker-layer-caching.md",
    "patternIds": [
      "OPT4"
    ],
    "detectionMode": "static",
    "retired": false
  }
]