The GitHub Actions optimization catalog
Every CI rule StarSling checks, as a page you can read and a catalog your coding agent can fetch. Each rule names how it is detected, the fix, and how to verify it.
20 rules in 4 categories
For coding agents
One compact JSON manifest lists every rule with its stable id, category, detection mode, and page URLs: /github-actions/catalog.json. This page mirrors to plain markdown at /github-actions/optimizations.md, and every rule page mirrors to its own .md.
Performance
Caching, sharding, scoping, and scheduling: the rules that decide how fast a run finishes.
Dependency caching
staticci.cache.dependency-cache
Shallow checkout
staticci.checkout.shallow-clone
Test sharding
staticci.parallel.test-sharding
Change-scoped builds
runtimeci.build.change-scoped
Path filters
staticci.trigger.path-filter
Superseded runs cancelled
hybridci.trigger.cancel-superseded
Concurrency groups
runtimeci.trigger.concurrency-groups
Right-sized runners
runtimeci.runner.right-sizing
Polling waits, not fixed sleeps
staticci.hygiene.polling-waits
Turborepo cache health
staticci.cache.turborepo
Docker layer caching
staticci.cache.docker-layers
Reliability
Timeouts and service readiness: the rules that keep runs from hanging or flaking.
Cost
The rules that stop CI from spending minutes and reviewer time it does not need.
Security
Permissions, pinning, secrets, and fork safety: the rules that close attack paths through CI.
Scoped OIDC id-token
staticci.security.scoped-id-token
Pinned action SHAs
staticci.security.pinned-action-shas
Scoped workflow permissions
staticci.security.workflow-permissions
Secret handling
staticci.security.secret-handling
pull_request_target safety
staticci.security.pull-request-target
Cache poisoning prevention
staticci.security.cache-isolation
Audit your repository
Hand this prompt to your coding agent to run the whole catalog against your repository.
Fetch https://starsling.dev/github-actions/catalog.json and read it. For each rule whose detectionMode is "static", fetch the markdown URL and run the page's detection steps against this repository. List every rule that applies, ordered by likely impact, with the file and line behind each finding. For "runtime" rules, list what run history you would need from the GitHub Actions API. Then propose fixes for the top findings and open them as a reviewable PR; do not apply changes blindly.Last updated 2026-08-20