GitHub Actions

CI that takes 25 minutes gets ignored, and a workflow with a write-token running untrusted code gets owned. This skill builds pipelines against two hard constraints at once - a speed budget developers will actually wait for, and a security posture that assumes PR authors are hostile - because retrofitting either into a sprawling workflow file is far more painful than starting right.

Operating procedure

Step 1: Gather inputs

• Stack and package manager (locks the caching strategy).
• Current wall-clock time of the slowest required check, and the test-suite runtime.
• Monorepo or single package; deploy targets and who may approve prod.
• Any use of forked PRs or pull_request_target today (security review trigger).

Step 2: Set the budgets

• PR feedback (all required checks) under 10 minutes wall-clock; under 5 is the mark of a healthy repo. Anything over 15 minutes changes developer behavior - people batch commits and stop running CI-first.
• No single job over 10 minutes; split or parallelize past that.
• Dependency-install step under 60 seconds on a warm cache; if npm ci runs 3+ minutes every build, caching is broken.
• Cache hit rate above 90% on PR builds. Check the cache step's output over a week of runs; a low rate means the key is too specific or the cache is thrashing the 10GB-per-repo eviction limit.