---
title: "The GitHub Actions Optimization Catalog | StarSling"
description: "Every CI rule StarSling checks, grouped by performance, reliability, cost, and security, with stable ci.* ids and a JSON manifest coding agents can fetch."
url: https://starsling.dev/github-actions/optimizations
canonicalUrl: https://starsling.dev/github-actions/optimizations
---

# The GitHub Actions optimization catalog

[GitHub Actions](https://starsling.dev/github-actions) / Optimizations

Last updated: 2026-08-20

20 public rules. Each row: stable id, how it is detected (static = repository contents alone; runtime = needs GitHub Actions run history; hybrid = both), and the canonical page carrying detection steps, the fix, and verification.

Machine manifest: https://starsling.dev/github-actions/catalog.json (one JSON row per rule: id, title, category, family, url, markdown, patternIds, detectionMode, retired).

<a id="performance"></a>

## Performance

- `ci.cache.dependency-cache` (static) - [Dependency caching](https://starsling.dev/best-practices/github-actions/cache-dependencies) ([markdown](https://starsling.dev/best-practices/github-actions/cache-dependencies.md))
- `ci.checkout.shallow-clone` (static) - [Shallow checkout](https://starsling.dev/best-practices/github-actions/shallow-checkout) ([markdown](https://starsling.dev/best-practices/github-actions/shallow-checkout.md))
- `ci.parallel.test-sharding` (static) - [Test sharding](https://starsling.dev/best-practices/github-actions/shard-tests) ([markdown](https://starsling.dev/best-practices/github-actions/shard-tests.md))
- `ci.build.change-scoped` (runtime) - [Change-scoped builds](https://starsling.dev/best-practices/github-actions/build-only-affected) ([markdown](https://starsling.dev/best-practices/github-actions/build-only-affected.md))
- `ci.trigger.path-filter` (static) - [Path filters](https://starsling.dev/best-practices/github-actions/path-filter-workflows) ([markdown](https://starsling.dev/best-practices/github-actions/path-filter-workflows.md))
- `ci.trigger.cancel-superseded` (hybrid) - [Superseded runs cancelled](https://starsling.dev/best-practices/github-actions/cancel-superseded-runs) ([markdown](https://starsling.dev/best-practices/github-actions/cancel-superseded-runs.md))
- `ci.trigger.concurrency-groups` (runtime) - [Concurrency groups](https://starsling.dev/best-practices/github-actions/cut-queue-time) ([markdown](https://starsling.dev/best-practices/github-actions/cut-queue-time.md))
- `ci.runner.right-sizing` (runtime) - [Right-sized runners](https://starsling.dev/best-practices/github-actions/right-size-runners) ([markdown](https://starsling.dev/best-practices/github-actions/right-size-runners.md))
- `ci.hygiene.polling-waits` (static) - [Polling waits, not fixed sleeps](https://starsling.dev/best-practices/github-actions/replace-fixed-sleeps-with-polling) ([markdown](https://starsling.dev/best-practices/github-actions/replace-fixed-sleeps-with-polling.md))
- `ci.cache.turborepo` (static) - [Turborepo cache health](https://starsling.dev/github-actions/optimizations/optimize-turborepo) ([markdown](https://starsling.dev/github-actions/optimizations/optimize-turborepo.md))
- `ci.cache.docker-layers` (static) - [Docker layer caching](https://starsling.dev/github-actions/optimizations/use-docker-layer-caching) ([markdown](https://starsling.dev/github-actions/optimizations/use-docker-layer-caching.md))

<a id="reliability"></a>

## Reliability

- `ci.hygiene.job-timeouts` (static) - [Job timeouts](https://starsling.dev/best-practices/github-actions/bound-job-timeouts) ([markdown](https://starsling.dev/best-practices/github-actions/bound-job-timeouts.md))
- `ci.hygiene.container-healthchecks` (static) - [Container healthchecks](https://starsling.dev/best-practices/github-actions/wait-for-container-healthchecks) ([markdown](https://starsling.dev/best-practices/github-actions/wait-for-container-healthchecks.md))

<a id="cost"></a>

## Cost

- `ci.hygiene.advisory-non-blocking` (runtime) - [Advisory checks non-blocking](https://starsling.dev/best-practices/github-actions/keep-advisory-checks-non-blocking) ([markdown](https://starsling.dev/best-practices/github-actions/keep-advisory-checks-non-blocking.md))

<a id="security"></a>

## Security

- `ci.security.scoped-id-token` (static) - [Scoped OIDC id-token](https://starsling.dev/best-practices/github-actions/scope-id-token-per-job) ([markdown](https://starsling.dev/best-practices/github-actions/scope-id-token-per-job.md))
- `ci.security.pinned-action-shas` (static) - [Pinned action SHAs](https://starsling.dev/best-practices/github-actions/pin-action-shas) ([markdown](https://starsling.dev/best-practices/github-actions/pin-action-shas.md))
- `ci.security.workflow-permissions` (static) - [Scoped workflow permissions](https://starsling.dev/best-practices/github-actions/limit-github-actions-permissions) ([markdown](https://starsling.dev/best-practices/github-actions/limit-github-actions-permissions.md))
- `ci.security.secret-handling` (static) - [Secret handling](https://starsling.dev/best-practices/github-actions/protect-github-actions-secrets) ([markdown](https://starsling.dev/best-practices/github-actions/protect-github-actions-secrets.md))
- `ci.security.pull-request-target` (static) - [pull_request_target safety](https://starsling.dev/best-practices/github-actions/secure-pull-request-target) ([markdown](https://starsling.dev/best-practices/github-actions/secure-pull-request-target.md))
- `ci.security.cache-isolation` (static) - [Cache poisoning prevention](https://starsling.dev/best-practices/github-actions/prevent-github-actions-cache-poisoning) ([markdown](https://starsling.dev/best-practices/github-actions/prevent-github-actions-cache-poisoning.md))

## Audit your repository

Fetch the machine manifest above, pick the rules whose detectionMode your context supports, read each rule's markdown page, run its detection steps, and open the fixes as a reviewable PR.