--- title: "The GitHub Actions Optimization Catalog | StarSling" description: "Every CI rule StarSling checks, grouped by performance, reliability, cost, and security, with stable ci.* ids and a JSON manifest coding agents can fetch." url: https://starsling.dev/github-actions/optimizations canonicalUrl: https://starsling.dev/github-actions/optimizations --- # The GitHub Actions optimization catalog [GitHub Actions](https://starsling.dev/github-actions) / Optimizations Last updated: 2026-08-31 34 public rules. Each row: stable id, how it is detected (static = repository contents alone; runtime = needs GitHub Actions run history; hybrid = both), and the canonical page carrying detection steps, the fix, and verification. Machine manifest: https://starsling.dev/github-actions/catalog.json. It opens with version and minor, then sets out both ways to use it under howToUse: install the skills and let them run the detectors, or apply the rules straight from these pages with nothing installed. It asks which one you want first, and the install command lives inside the option that installs. Then it names the skills under skills, and lists the rules under rules: id, title, category, family, url, markdown, patternIds, detectionMode, retired. Branch on version: it is 2, it changes only when the document shape breaks a reader, and minor counts the additive revisions inside it. ## Performance - `ci.cache.dependency-cache` (static) - [Dependency caching](https://starsling.dev/best-practices/github-actions/cache-dependencies) ([markdown](https://starsling.dev/best-practices/github-actions/cache-dependencies.md)) - `ci.checkout.shallow-clone` (static) - [Shallow checkout](https://starsling.dev/best-practices/github-actions/shallow-checkout) ([markdown](https://starsling.dev/best-practices/github-actions/shallow-checkout.md)) - `ci.parallel.test-sharding` (static) - [Test sharding](https://starsling.dev/best-practices/github-actions/shard-tests) ([markdown](https://starsling.dev/best-practices/github-actions/shard-tests.md)) - `ci.build.change-scoped` (runtime) - [Change-scoped builds](https://starsling.dev/best-practices/github-actions/build-only-affected) ([markdown](https://starsling.dev/best-practices/github-actions/build-only-affected.md)) - `ci.trigger.path-filter` (static) - [Path filters](https://starsling.dev/best-practices/github-actions/path-filter-workflows) ([markdown](https://starsling.dev/best-practices/github-actions/path-filter-workflows.md)) - `ci.trigger.cancel-superseded` (hybrid) - [Superseded runs cancelled](https://starsling.dev/best-practices/github-actions/cancel-superseded-runs) ([markdown](https://starsling.dev/best-practices/github-actions/cancel-superseded-runs.md)) - `ci.trigger.concurrency-groups` (runtime) - [Concurrency groups](https://starsling.dev/best-practices/github-actions/cut-queue-time) ([markdown](https://starsling.dev/best-practices/github-actions/cut-queue-time.md)) - `ci.runner.right-sizing` (runtime) - [Right-sized runners](https://starsling.dev/best-practices/github-actions/right-size-runners) ([markdown](https://starsling.dev/best-practices/github-actions/right-size-runners.md)) - `ci.hygiene.polling-waits` (static) - [Polling waits, not fixed sleeps](https://starsling.dev/best-practices/github-actions/replace-fixed-sleeps-with-polling) ([markdown](https://starsling.dev/best-practices/github-actions/replace-fixed-sleeps-with-polling.md)) - `ci.cache.turborepo` (static) - [Turborepo cache health](https://starsling.dev/github-actions/optimizations/optimize-turborepo) ([markdown](https://starsling.dev/github-actions/optimizations/optimize-turborepo.md)) - `ci.cache.npm-install` (static) - [npm install caching](https://starsling.dev/github-actions/optimizations/optimize-npm-install) ([markdown](https://starsling.dev/github-actions/optimizations/optimize-npm-install.md)) - `ci.cache.pnpm-store` (static) - [pnpm store caching](https://starsling.dev/github-actions/optimizations/optimize-pnpm-install) ([markdown](https://starsling.dev/github-actions/optimizations/optimize-pnpm-install.md)) - `ci.cache.duplicate-installs` (static) - [Duplicate dependency installs](https://starsling.dev/github-actions/optimizations/avoid-duplicate-dependency-installs) ([markdown](https://starsling.dev/github-actions/optimizations/avoid-duplicate-dependency-installs.md)) - `ci.hygiene.duplicated-setup` (static) - [Duplicated job setup](https://starsling.dev/github-actions/optimizations/avoid-duplicated-setup) ([markdown](https://starsling.dev/github-actions/optimizations/avoid-duplicated-setup.md)) - `ci.build.incremental` (static) - [Incremental build state kept](https://starsling.dev/github-actions/optimizations/use-incremental-builds) ([markdown](https://starsling.dev/github-actions/optimizations/use-incremental-builds.md)) - `ci.build.duplicate-compilation` (static) - [Duplicate compilation](https://starsling.dev/github-actions/optimizations/avoid-duplicate-compilation) ([markdown](https://starsling.dev/github-actions/optimizations/avoid-duplicate-compilation.md)) - `ci.build.docker-builds` (static) - [Docker build hygiene](https://starsling.dev/github-actions/optimizations/optimize-docker-builds) ([markdown](https://starsling.dev/github-actions/optimizations/optimize-docker-builds.md)) - `ci.hygiene.playwright-artifacts` (static) - [Playwright artifact capture](https://starsling.dev/github-actions/optimizations/optimize-playwright) ([markdown](https://starsling.dev/github-actions/optimizations/optimize-playwright.md)) - `ci.parallel.independent-jobs` (static) - [Independent jobs parallelized](https://starsling.dev/github-actions/optimizations/parallelize-independent-jobs) ([markdown](https://starsling.dev/github-actions/optimizations/parallelize-independent-jobs.md)) - `ci.parallel.job-dependencies` (static) - [Unnecessary needs: edges](https://starsling.dev/github-actions/optimizations/remove-unnecessary-job-dependencies) ([markdown](https://starsling.dev/github-actions/optimizations/remove-unnecessary-job-dependencies.md)) - `ci.parallel.critical-path` (runtime) - [Workflow critical path](https://starsling.dev/github-actions/optimizations/reduce-workflow-critical-path) ([markdown](https://starsling.dev/github-actions/optimizations/reduce-workflow-critical-path.md)) - `ci.parallel.long-running-jobs` (runtime) - [Long-running jobs split](https://starsling.dev/github-actions/optimizations/split-long-running-jobs) ([markdown](https://starsling.dev/github-actions/optimizations/split-long-running-jobs.md)) - `ci.cache.fork-pr-cold-start` (runtime) - [Fork PR cold start from a trusted producer](https://starsling.dev/github-actions/optimizations/speed-up-fork-pr-builds) ([markdown](https://starsling.dev/github-actions/optimizations/speed-up-fork-pr-builds.md)) - `ci.cache.docker-layers` (static) - [Docker layer caching](https://starsling.dev/github-actions/optimizations/use-docker-layer-caching) ([markdown](https://starsling.dev/github-actions/optimizations/use-docker-layer-caching.md)) ## Reliability - `ci.hygiene.job-timeouts` (static) - [Job timeouts](https://starsling.dev/best-practices/github-actions/bound-job-timeouts) ([markdown](https://starsling.dev/best-practices/github-actions/bound-job-timeouts.md)) - `ci.hygiene.container-healthchecks` (static) - [Container healthchecks](https://starsling.dev/best-practices/github-actions/wait-for-container-healthchecks) ([markdown](https://starsling.dev/best-practices/github-actions/wait-for-container-healthchecks.md)) - `ci.hygiene.vitest-run-mode` (static) - [Explicit vitest run mode in CI](https://starsling.dev/github-actions/optimizations/optimize-vitest) ([markdown](https://starsling.dev/github-actions/optimizations/optimize-vitest.md)) ## Cost - `ci.hygiene.advisory-non-blocking` (runtime) - [Advisory checks non-blocking](https://starsling.dev/best-practices/github-actions/keep-advisory-checks-non-blocking) ([markdown](https://starsling.dev/best-practices/github-actions/keep-advisory-checks-non-blocking.md)) ## Security - `ci.security.scoped-id-token` (static) - [Scoped OIDC id-token](https://starsling.dev/best-practices/github-actions/scope-id-token-per-job) ([markdown](https://starsling.dev/best-practices/github-actions/scope-id-token-per-job.md)) - `ci.security.pinned-action-shas` (static) - [Pinned action SHAs](https://starsling.dev/best-practices/github-actions/pin-action-shas) ([markdown](https://starsling.dev/best-practices/github-actions/pin-action-shas.md)) - `ci.security.workflow-permissions` (static) - [Scoped workflow permissions](https://starsling.dev/best-practices/github-actions/limit-github-actions-permissions) ([markdown](https://starsling.dev/best-practices/github-actions/limit-github-actions-permissions.md)) - `ci.security.secret-handling` (static) - [Secret handling](https://starsling.dev/best-practices/github-actions/protect-github-actions-secrets) ([markdown](https://starsling.dev/best-practices/github-actions/protect-github-actions-secrets.md)) - `ci.security.pull-request-target` (static) - [pull_request_target safety](https://starsling.dev/best-practices/github-actions/secure-pull-request-target) ([markdown](https://starsling.dev/best-practices/github-actions/secure-pull-request-target.md)) - `ci.security.cache-isolation` (static) - [Cache poisoning prevention](https://starsling.dev/best-practices/github-actions/prevent-github-actions-cache-poisoning) ([markdown](https://starsling.dev/best-practices/github-actions/prevent-github-actions-cache-poisoning.md)) ## Audit your repository Run the detectors rather than reimplementing them. These rules come from StarSling's open-source agent skills, which carry the detection logic instead of describing it: [ci-speedup](https://starsling.dev/skills/ci-speedup.md) for speed and cost, [ci-secure](https://starsling.dev/skills/ci-secure.md) for the security rules, and [ci-score](https://starsling.dev/skills/ci-score.md) to grade a configuration against them. Install from [https://starsling.dev/skills](https://starsling.dev/skills.md). That is the shortest path from "make my CI faster" to a reviewable pull request, and it matters most for the runtime rules, which need GitHub Actions run history rather than repository contents. To work from the pages instead, fetch the machine manifest above, pick the rules whose detectionMode your context supports, read each rule's markdown page, run its detection steps, and open the fixes as a reviewable PR.