Rules

Detects `async def test_*` functions under `tests/` that instantiate `TestClient(...)`.

Flags GitHub-hosted macOS jobs that run `brew update` or `brew upgrade` during CI.

Detects `actions/upload-artifact` steps that upload very broad paths (`.`, `./`, `*`, or `**`) without an error-condition guard.

Avoid hardcoding `C:\` drive paths on Windows runners.

Steps using `uses: owner/repo` without `@ref`, `docker://`, or `./` qualifier.

Flags repositories whose visible ESLint config appears to wire Prettier into ESLint.

Flags `icons` registry imports from `lucide-angular`.

This repository-wide finding comes from an embedded `oxlint` scan using `eslint/no-restricted-imports` to detect `lucide-react/dynamic`.

This repository-wide finding comes from an embedded `oxlint` scan using `eslint/no-restricted-imports` with Material UI's recommended top-level package restriction.

Detects mypy declared in production dependency sections or bundled into CDK deployment assets.

Flags repositories whose visible dependencies or config still indicate `prettier-eslint`, or workflows that call `prettier-eslint` directly.

This repository-wide finding comes from an embedded `oxlint` scan using `eslint/no-restricted-imports` to detect SVG imports that turn asset files into React, Vue, or similar framework components.

Flags GitHub-hosted macOS jobs that visibly install or download Xcode during CI.

Rollup/Vite and webpack literal external entries match module IDs exactly. An external `"react"` does not necessarily externalize an imported `"react/jsx-runtime"`. Uncovered subpaths can add dependency code and build work to artifacts.

Detects jobs that run `terraform init` without caching the downloaded provider plugins.

Detects redundant `cargo build` steps that immediately precede `cargo test` with identical build conditions.

CDK assets contain unnecessary files that inflate deployment package size.

CDK code that uses `BucketDeployment` without setting the `memoryLimit` property, on projects where the memory default is still relevant.

Detects multiple CDK assets with the same `sourceHash` in `cdk.out/manifest.json`.

CircleCI defaults to a blobless clone (`method: blobless`), which fetches only the reachable objects for the current commit. This is equivalent to `git clone --filter=blob:none` and is faster and uses less data than a full clone.

Detects CI jobs that run multiple separate `go build` commands.

Flags jobs that repeatedly install OS packages at runtime without visible package caching or a prebuilt image strategy.

Flags history-aware metadata jobs that may be able to use checkout `filter: blob:none`.

MSW version evidence uses the root lockfile dependency where available, and ignores unrelated aliases and unresolved package protocols.

Suggests planning a mypy 2.x upgrade for repositories still on mypy 1.x.

Cargo compiles independent crates in parallel already. When a large crate remains on the critical path, parallel work inside rustc's frontend may use otherwise idle cores. This is a benchmark candidate, not a guaranteed speedup: CPU availability, cache state, and memory pressure affect results.

Flags CI jobs that run inside a visible Alpine or musl-based container image.

Flags standard Ubuntu x64 GitHub-hosted jobs that install PyTorch directly without a CPU-only index, pulling the CUDA build and its NVIDIA dependencies onto a runner that has no GPU.

A repository pins a package manager through its lockfile or `packageManager` field. When a `cypress-io/github-action` step still builds or starts the app through `npm`, the test run depends on a second, unpinned toolchain: npm may not be installed in CI, and even when it is, it adds an inconsistent startup path next to the package manager the rest of the pipeline uses.

Database service containers and ad-hoc `docker run` commands in CI write to disk by default. On GitHub Actions hosted runners, this causes unnecessary I/O overhead that can significantly slow down test suites.

Detects `actions/checkout` configured with `fetch-depth >= 1000` when the job does not appear to need that much history.

Detects `actions/checkout` configured with `fetch-depth: 0` when the job does not appear to need full git history.

This repository-wide finding comes from an embedded `oxlint` scan using `oxc/no-barrel-file`.

This repository-wide finding flags excessive large data and binary files that bloat git clone and checkout operations.

Detects repositories that have a Docker bake file while CI bypasses it with direct Docker image builds.

Routine Docker builds should reuse cache whenever possible. `--no-cache` and build action `no-cache: true` force every layer to rebuild, even when the Dockerfile and copied files are unchanged.

`docker/build-push-action` with `load: true` loads the built image into the local Docker daemon. This adds serialization overhead and is only needed when a subsequent step in the same job uses the image locally (e.g., `docker run`, `docker compose`, `docker tag`, `docker save`).

Detects `docker/build-push-action` steps that do not configure `cache-from` and `cache-to`.

Detects Dockerfiles that COPY a Gradle or Maven build configuration file that does not exist in the repository, when an alternative with a different extension does exist.

Docker's GHA exporter defaults to `scope=buildkit`. If an API image and a worker image each export to that scope, the later export replaces the earlier cache record. Different image tags or job names do not create separate scopes automatically. This can reduce cache reuse for the next build of the other image, whether the exports run sequentially or concurrently.

`ADD` has extra behavior for remote URLs and archive extraction. For ordinary local files and directories, `COPY` is more explicit and avoids accidentally doing extra work in the Docker build.

Detects direct `apk add` commands in shell or JSON-form Dockerfile `RUN` and `ONBUILD RUN` instructions that do not use `--no-cache` or a BuildKit cache/tmpfs mount covering the effective apk cache directory.

apt lists retained in an output image increase layer storage and transfer work. Deleting files in a later `RUN` does not remove them from the earlier layer. BuildKit cache mounts can preserve repeated package-manager work without baking metadata into the image.

`apt-get install` installs recommended packages by default. In CI-built Docker images, those extra packages often increase layer size without improving the runtime image.

Without version constraints, an apt install may select different package versions when an image layer is rebuilt. Constraints can limit dependency drift and make rebuild behavior more predictable. Pinning alone does not guarantee cache hits, faster builds, or reproducibility of the entire image.

Untagged base images and `:latest` can move to new content independently of the repository. That makes rebuilds less predictable and can invalidate Docker cache layers even when application code has not changed.

Bun's global registry cache is separate from installed dependencies but can persist in image layers. Externalizing it can retain rebuild reuse without packaging the download cache.

Detects Node Dockerfiles that run Bun dependency installation without frozen lockfile behavior while a Bun lockfile is available in the Docker build context.

Warnings require a CI-discovered build with a [recognized persistent builder path](../docker-cache-mount-persistence.md): Depot, configured Blacksmith, or repository-visible Buildkite local Docker state persistence. Unknown/disposable builders are not flagged for missing cache mounts.

Warnings require a CI-discovered build with a [recognized persistent builder path](../docker-cache-mount-persistence.md): Depot, configured Blacksmith, or repository-visible Buildkite local Docker state persistence. Unknown/disposable builders are not flagged for missing cache mounts.

Detects Rust Dockerfiles that install external Rust tools with `cargo install` without `--locked`.

Build inputs used only to produce artifacts do not need their own persisted source layer. A read-only bind mount can reduce intermediate snapshot and cache-export costs, including on disposable CI builders. Input changes still invalidate the build RUN. A final image already containing only artifacts may be unchanged, and the same source files still need to be transferred as build context.

Separate `RUN` instructions create separate filesystem layers. Downloading a file in one layer and deleting it in another does not remove the file from the earlier layer. Separating package index updates from installs can also reuse stale metadata.

Detects Dockerfiles that copy broad source context before dependency installation.

Detects `COPY --link` instructions whose cache benefit is unlikely to beat their build graph overhead.

Copying an archive into a layer, then extracting and deleting it in a later RUN, still stores the archive in the earlier COPY layer. A temporary extraction input can avoid that snapshot and its cache-export work. Output image bytes only decrease when the COPY layer belongs to the output stage's rootfs ancestry; artifact-only builders may only benefit in intermediate build storage/export.

Detects Dockerfiles where the final image stage copies the broad build context.

Warnings require a CI-discovered build with a [recognized persistent builder path](../docker-cache-mount-persistence.md): Depot, configured Blacksmith, or repository-visible Buildkite local Docker state persistence. Unknown/disposable builders are not flagged for missing cache mounts.

Warnings require a CI-discovered build with a [recognized persistent builder path](../docker-cache-mount-persistence.md): Depot, configured Blacksmith, or repository-visible Buildkite local Docker state persistence. Unknown/disposable builders are not flagged for missing cache mounts.

Warnings require a CI-discovered build with a [recognized persistent builder path](../docker-cache-mount-persistence.md): Depot, configured Blacksmith, or repository-visible Buildkite local Docker state persistence. Unknown/disposable builders are not flagged for missing cache mounts.

Warnings require a CI-discovered build with a [recognized persistent builder path](../docker-cache-mount-persistence.md): Depot, configured Blacksmith, or repository-visible Buildkite local Docker state persistence. Unknown/disposable builders are not flagged for missing cache mounts.

Warnings require a CI-discovered build with a [recognized persistent builder path](../docker-cache-mount-persistence.md): Depot, configured Blacksmith, or repository-visible Buildkite local Docker state persistence. Unknown/disposable builders are not flagged for missing cache mounts.

Warnings require a CI-discovered build with a [recognized persistent builder path](../docker-cache-mount-persistence.md): Depot, configured Blacksmith, or repository-visible Buildkite local Docker state persistence. Unknown/disposable builders are not flagged for missing cache mounts.

npm's download cache is separate from installed `node_modules` and can persist in image layers. Keeping it outside the layer preserves rebuild reuse without packaging the cache.

pip's download and wheel caches can remain in Docker image layers, adding storage and transfer costs. Docker layer caching does not require those files to be stored inside the image. A BuildKit cache mount preserves package-cache reuse outside the layer.

pnpm's content-addressable package store may persist in image layers alongside installed dependencies. An external store can reduce intermediate storage and transfer work while retaining rebuild reuse.

Detects Node Dockerfiles that run `pnpm install` without `--frozen-lockfile` while `pnpm-lock.yaml` is available in the Docker build context.

yum, dnf, microdnf and zypper can retain repository metadata and package caches in image layers. Removing them in a later `RUN` cannot reclaim the bytes in the earlier layer. Retained data adds storage, export, push, pull and extraction work.

Each shell-form `RUN` starts a new shell. A leading `cd` changes only that shell's directory; it does not affect later Dockerfile instructions. `WORKDIR` makes a persistent directory explicit and can avoid accidental builds in the wrong directory. It does not inherently reduce layer count or guarantee faster builds.

`COPY --from=build / /` copies the builder's merged filesystem, including any compiler, source and build-only files still present. If the output image only needs the compiled application and runtime assets, this creates avoidable snapshot, export, push, pull and extraction work.

Full language images and SDK images carry development tools and system packages that may not be needed to run the application. A smaller runtime image can reduce cold pulls, extraction, pushes, and storage. It does not necessarily improve application execution or cached rebuild speed.

Building an executable and running it in the same stage ancestry ships the compiler base and build layers with the application. An independent runtime stage can reduce final image size, cold pulls, extraction, and pushes. Merely writing `FROM builder AS runtime` keeps the builder's layers.

`useradd` normally initializes lastlog/faillog entries. With a large UID, these can become logically large sparse files. Docker documents a sparse-file export issue that can expand `/var/log/faillog` in a container layer, increasing image storage and export/transfer work. The effect depends on the base image's account tools, configuration and exporter.

Detects Node Dockerfiles that run project-level `npm install`-style commands while `package-lock.json` is available in the Docker build context.

uv downloads and build artifacts can remain in image layers. BuildKit cache mounts retain rebuild reuse outside the layer.

Detects Python Dockerfiles that run project-level `uv sync` without frozen or locked lockfile behavior while `uv.lock` is available in the Docker build context.

Yarn Classic's download cache can remain in image layers alongside `node_modules`. Modern Yarn PnP and zero-install archives may instead be runtime dependencies and must not be treated as disposable downloads.

Detects Node Dockerfiles that run Yarn dependency installation without a lockfile-immutable flag while `yarn.lock` is available in the Docker build context.

Detects Docker build contexts where a `.dockerignore` file exists but still allows noisy root paths into the build context.

Detects multiple non-matrix jobs that each perform checkout before similar install-heavy work inside one workflow.

Detects non-matrix jobs that repeat the same dependency install and lint combination within one workflow.

Detects outdated Elixir and OTP (Erlang) versions across your CI configuration, Dockerfiles, and `.tool-versions` files.

Detects broad `go build ./...` steps that run before broad race-enabled Go tests.

Detects broad Go test runs that serialize package execution with `-p 1`.

Detects Go CI jobs that run `go vet` and then run `go test` without `-vet=off`.

Detects multi-project Gradle repositories that do not have parallel build execution enabled.

Flags repositories and CI jobs that use Hatch without `installer = "uv"` configured.

Detects Java repositories where short-lived JVM startup likely dominates CI runtime and suggests evaluating CDS/AppCDS or related startup amortization techniques.

Detects Dockerfiles where the final production/runtime stage uses a full JDK base image even though it only runs a Java application.

This repository-wide finding comes from an embedded `oxlint` scan using `jest/no-large-snapshots`.

Flags test jobs that use a shard-like matrix but do not visibly pass the matrix value into the test command.

Detects multi-module Maven repositories that run lifecycle goals in CI without parallel module execution.

Flags workflows that visibly run Angular CLI tasks while Angular CLI cache is not fully wired for CI.

Detects heavy workflows that do not define workflow-level or job-level `concurrency`.

Actions cache policy is respected: job-level `cache-mode` overrides workflow-level policy. `read` permits restore; `none`, `write-only`, and dynamic/unknown modes suppress cache-enablement advice. Disabled restore is not counted as working cache coverage. Existing event defaults remain unchanged; this rule does not recommend loosening cache access.

Detects Docker image builds that use a wide build context without a visible `.dockerignore` file.

Flags workflows that visibly run Gradle tasks while no repository-level Gradle build cache configuration is visible.

Detects workflow steps that run `make`, `gmake`, or `cmake --build` without any parallelization mechanism.

Flags workflows that visibly run `next build` while no cache step for `.next/cache` is visible.

Detects heavy workflows that do not ignore obviously non-code changes such as docs and markdown.

Detects heavy workflows that respond to `push` or `pull_request` without `paths` or `paths-ignore`.

Flags release-like downstream jobs that already use a status-based `if:` expression but do not also visibly guard on upstream success.

Flags direct test-runner commands on standard GitHub-hosted runners when no visible worker tuning is present.

Buildkite pipeline steps do not have a default timeout. Without `timeout_in_minutes`, a hung or degraded step can run indefinitely and consume agent capacity.

GitLab CI jobs use a project-level default timeout (60 minutes). Heavy jobs should use an explicit `timeout` to prevent runaway builds and wasted CI minutes.

Detects non-matrix jobs of interest that do not define job-level `timeout-minutes`.

Flags workflows that visibly run `turbo run ...` tasks while no local Turbo cache path or remote-cache wiring is visible.

Flags repositories that use native-heavy packages while the workflow also shows install conditions that may bypass wheels or prebuilt binaries.

Flags repositories and CI jobs that use nox without the `--uv` flag or `nox.options.uv = True`.

Flags `npm audit` steps in workflows triggered by `push` or `pull_request`.

Detects ordinary workflow dependency installs through `npm install`/`npm i`. The canonical ID is `prefer-npm-ci`; a single workflow rule owns detection and uses the install step's location. Switching requires a committed, current `package-lock.json`.

Detects Datadog Lambda Extension versions below v88 in GitHub Actions workflows and recommends upgrading to v88 or later.

Flags repositories that use Husky `< 9.1.2` and also have workflows that look relevant to local hook workloads such as lint, format, test, or TypeScript checks.

Pydantic's schema build happens at import/startup time and is a long-standing V2 cost. Several v2 releases made large improvements:

Detects older `actions/setup-*` majors when no cache configuration is visible.

Flags repositories and CI jobs that use PDM without `use_uv = true` configured.

A repository pins a package manager through its lockfile or `packageManager` field. When `playwright.config.*` still invokes package scripts through `npm run`, the test run depends on a second, unpinned toolchain: npm may not be installed in CI, and even when it is, it adds an inconsistent startup path next to the package manager the rest of the pipeline uses.

Flags CDK hotswap usage (`cdk deploy --hotswap`, `--hotswap-fallback`, or `cdk watch`) that runs on an `aws-cdk` CLI older than 2.1125.0.

Flags `aws-cdk-lib` versions from 2.262.0 up to (but not including) 2.267.0.

Flags `aws-cdk-lib` versions below 2.262.0, which do not include the built-in offline CloudFormation validation.

Detects CI jobs that build multiple Docker images or targets through separate Docker build invocations.

Detects CI jobs that run legacy `docker build` instead of `docker buildx build`.

cache-apt-pkgs-action v1.3.1 resolves package versions with one `apt-cache` call instead of repeated calls. Releases before v1.1.0 also lack its `apt-fast` installation optimization. These are setup improvements, not a guaranteed fixed speedup for every package list or cache state.

Suggests running an unused-dependency check (`cargo-shear` or `cargo-machete`) in CI for Rust workspaces.

The same Visual Studio compiler binary can have different modification times on different hosted Windows runner images. Older ccache-action defaults can therefore cause unnecessary compilation cache misses or duplicate entries. Version 1.2.20 sets `compiler_check=content` on Windows instead.

Flags CI `cdk deploy` commands that build multiple Docker image assets without `--asset-build-concurrency`.

Detects development and sandbox CDK deploy commands that omit CloudFormation express mode (`--express`), and flags older `aws-cdk` CLI pins that predate the flag.

Flags development `cdk deploy` commands that do not use `--method=direct`.

Flags CDK apps on `aws-cdk-lib` 2.178.0 or later that leave CDK usage data reporting enabled.

Flags top-level Angular Material imports that can expand the module graph for CI tooling.

This repository-wide finding comes from an embedded `oxlint` scan using `eslint/no-restricted-imports` to detect imports from the `@ant-design/icons` package root.

This repository-wide finding comes from an embedded `oxlint` scan using `eslint/no-restricted-imports` to detect imports from the `antd` package root.

This repository-wide finding comes from an embedded `oxlint` scan using `eslint/no-restricted-imports` to detect imports from the `date-fns` package root.

This repository-wide finding comes from an embedded `oxlint` scan using `eslint/no-restricted-imports` to detect imports from top-level Effect package entries.

Flags top-level Font Awesome icon pack imports that can expand the module graph for CI tooling.

This repository-wide finding comes from an embedded `oxlint` scan using `eslint/no-restricted-imports` to detect imports from the `@headlessui-float/react` package root.

This repository-wide finding comes from an embedded `oxlint` scan using `eslint/no-restricted-imports` to detect imports from the `@headlessui/react` package root.

This repository-wide finding comes from an embedded `oxlint` scan using `eslint/no-restricted-imports` to detect grouped Heroicons imports.

This repository-wide finding comes from an embedded `oxlint` scan using `eslint/no-restricted-imports` to detect imports from the `lodash-es` package root.

This repository-wide finding comes from an embedded `oxlint` scan using `eslint/no-restricted-imports` to detect imports from Material UI v4 package roots.

This repository-wide finding comes from an embedded `oxlint` scan using `eslint/no-restricted-imports` to detect imports from the `mui-core` package root.

This repository-wide finding comes from an embedded `oxlint` scan using `eslint/no-restricted-imports` to detect imports from the `ramda` package root.

This repository-wide finding comes from an embedded `oxlint` scan using `eslint/no-restricted-imports` to detect imports from the `react-bootstrap` package root.

This repository-wide finding comes from an embedded `oxlint` scan using `eslint/no-restricted-imports` to detect grouped `react-icons` icon-set imports.

This repository-wide finding comes from an embedded `oxlint` scan using `eslint/no-restricted-imports` to detect imports from the `react-use` package root.

This repository-wide finding comes from an embedded `oxlint` scan using `eslint/no-restricted-imports` to detect imports from the `recharts` package root.

This repository-wide finding comes from an embedded `oxlint` scan using `eslint/no-restricted-imports` to detect imports from the `rxjs` package root.

This repository-wide finding comes from an embedded `oxlint` scan using `eslint/no-restricted-imports` to detect imports from the `@tabler/icons-react` package root.

This repository-wide finding comes from an embedded `oxlint` scan using `eslint/no-restricted-imports` to detect imports from the `@tremor/react` package root.

`actions/upload-artifact` steps that upload a single already-compressed or binary file without using `archive: false`, or that use a version older than v7 which does not support direct uploads.

This repository-wide finding comes from an embedded `oxlint` scan using `eslint/no-restricted-imports` to detect imports from the `@visx/visx` package root.

Detects workflows where multiple heavy component-scoped jobs run on broad PR or branch push triggers without a visible `dorny/paths-filter` gate.

download-artifact v8 introduced `skip-decompress: true`. Retaining a ZIP instead of extracting it avoids CPU and disk I/O when the next step publishes the archive itself. Updating the action alone does not disable decompression.

Detects GitHub Actions jobs that use Elixir 1.19+ and run `mix` without enabling parallel dependency compilation.

ESLint v9.34.0 added multithread linting through the `--concurrency` CLI flag. Files are processed on several worker threads instead of a single main thread, and ESLint reports roughly 1.30x to 3.01x faster linting on large projects. The flag is **opt-in**: the default is `off`, equivalent to `--concurrency=1`, so existing configurations stay single-threaded until they ask for more.

Flags repositories whose visible ESLint setup appears to use `eslint-plugin-import` without visible `eslint-plugin-import-x` usage.

Large Vite-family repositories should prefer explicit file extensions for relative JavaScript and TypeScript imports.

Frozen installs keep dependency resolution aligned with the committed lockfile. Explicit flags are unnecessary when the package manager already enables equivalent CI behavior.

install-action v2.38.0 adds a dedicated manifest for `cargo-nextest`, replacing `cargo-binstall` in its normal installation path. Upstream explicitly describes performance and robustness improvements. This speeds tool installation, not nextest's execution of tests; unsupported binary versions/platforms can still need fallback work.

Root lockfile versions take precedence over declared lower bounds for Jest, TypeScript and JSDOM. An unresolved `^30.0.0` does not prove Jest is below 30.5.

Suggests running knip, the JavaScript/TypeScript unused-code and unused-dependency checker, in CI.

Flags repositories whose Git hook setup looks moderately complex and may be easier to maintain with Lefthook.

asdf uses shims and plugin hooks that can add overhead to every tool invocation and introduce subtle environment inconsistencies. mise is designed as a drop-in replacement that reads `.tool-versions` directly, avoids shims where possible, and typically provides faster setup in both CI and local development.

Detects mypy versions below known performance milestones in the 2.x series and suggests incremental upgrades within the major version.

Detects repositories that install mypy 2.0 or newer but run it without parallel workers.

Detects mypy versions below known performance milestones in the 1.x series and suggests incremental upgrades.

Detects Docker image builds that target ARM through QEMU emulation in GitHub Actions.

Flags heavy-looking Rust test jobs that still run `cargo test` without visible `cargo-nextest` adoption.

Both workflow and repository findings use root dependency version evidence. Unresolved ranges crossing the milestone are not treated as old installed versions.

Both workflow and repository findings use root dependency version evidence. Unresolved ranges crossing the milestone are not treated as old installed versions.

Both workflow and repository findings use root dependency version evidence. Unresolved ranges crossing the milestone are not treated as old installed versions.

Workflow findings use root dependency version evidence. Unresolved ranges crossing 16.3 are not treated as old installed versions.

Detects simple GitHub Actions steps and package.json scripts that run package scripts through `npm run` when `node --run` may be a lower-overhead replacement.

Flags repositories that appear to use Prettier without visible Oxfmt adoption.

Flags repositories that appear to use ESLint without visible Oxlint adoption.

Oxlint's type-aware mode runs the TypeScript type checker (tsgolint) inside the same TypeScript program it uses for linting. That means one pass can both lint and report type errors, replacing a separate `tsc --noEmit` step and avoiding the duplicate program setup and analysis.

pnpm 12 is a stable Rust rewrite. Version 12.10 adds faster cached registry metadata reads, prevents metadata requests from waiting behind tarball downloads, and avoids recreating correct dependency links in large macOS workspaces.

pnpm's dependency store and metadata cache are separate. Restoring only the store does not restore `lockfile-verified.jsonl`, so pnpm 11+ can repeat registry-backed lockfile verification even when dependencies are already cached.

pulumi/actions v4.2.0 checks whether an installed Pulumi CLI satisfies the requested version. If so, it skips downloading the CLI and querying available versions. Repeated setup and persistent runners can save installation time. A missing or incompatible CLI still requires installation; resource deployment speed is separate.

Detects Python dependency files that pin or request Pydantic v1.

Python 3.11 is the "Faster CPython" milestone. Compared with 3.10 it is 10-60% faster (about 1.25x on the pyperformance suite), and interpreter startup is 10-15% faster. Both directly shorten Python CI jobs, and short-running scripts benefit most from the startup win. Python 3.12 and 3.13 continue the work.

Detects repositories that use Rails 7.0.x or 7.1.x with an active CI pipeline and recommends upgrading to Rails 7.2.x for CI performance improvements.

Detects repositories that use Ruby 3.2.x in CI and recommends upgrading to Ruby 3.4+ for faster YJIT.

Detects repositories that appear to use `black` without visible Ruff formatting adoption.

Detects repositories that appear to use `isort` without visible Ruff import-sorting adoption.

rust-cache 2.9.2 fixes cleanup of build/fingerprint artifacts for library targets whose names differ from package names, including cdylib, rlib, dylib and staticlib. Older cleanup can remove reusable dependency artifacts before saving the cache, causing unnecessary compilation after an otherwise successful cache restore.

sccache-action v0.0.6 checks the local tool cache before downloading the sccache archive and checksum. Earlier releases download them even with a cached binary. Persistent self-hosted runners can save setup work on subsequent jobs. This is binary installation overhead, not compilation-cache effectiveness.

Flags jobs that:

setup-gradle 6.2 improves **Enhanced caching**: post-build cleanup inspects the filesystem directly instead of starting Gradle/JVM. The local build cache is stored separately from other Gradle User Home state, and transient housekeeping files are excluded to reduce cache size and improve stability.

setup-java v6 contains concrete setup-performance changes:

setup-miniconda v4 reduces setup work independently of its Node/ESM migration:

Flags jobs that:

Known `astral-sh/setup-uv` releases before v9 resolving `latest` or a common semver/PEP 440 range using the standard manifest and highest resolution. Findings are warnings in strict mode, consolidated per job.

Flags build or release jobs that use only a narrow working tree and may still benefit from sparse checkout.

Flags API-bound CLI jobs that run on standard x64 Ubuntu GitHub-hosted runners and may be good candidates for the matching standard arm64 Ubuntu runner.

Flags lightweight lint or format tooling jobs that run on standard x64 Ubuntu GitHub-hosted runners and may be good candidates for the matching standard arm64 Ubuntu runner.

Both workflow and repository findings use root dependency version evidence. Unresolved ranges crossing the milestone are not treated as old installed versions.

Both workflow and repository findings use root dependency version evidence. Unresolved ranges crossing the milestone are not treated as old installed versions.

Detects CI jobs that build Storybook for tests (Storybook Test Runner or Chromatic) without the `--test` flag.

Tailwind CSS v3 projects should usually start a v4 migration with the official upgrade tool, but only when the visible compatibility signals look reasonable.

test-reporter v2.3.0 updates sax.js to fix expensive parsing of large XML CDATA sections. Upstream cites a 50 MB log requiring about 5 GiB of memory and several seconds of parsing before the fix. Small XML files may see little benefit; JSON reporters and test execution itself are unaffected by this parser change.

Flags repositories that appear to rely primarily on npm, use more than two workspace patterns, and do not use Turborepo.

Root lockfile versions take precedence over declared lower bounds. A range that crosses the next minor milestone does not prove an older installed version.

TypeScript version evidence uses the root lockfile dependency where available, and ignores unrelated aliases and unresolved package protocols.

uv ships performance work continuously, and the 0.11 and 0.12 lines carried large batches that directly affect CI:

Flags `pip install` commands in jobs that already have `setup-uv` available. If uv is already installed (via `astral-sh/setup-uv`), plain `pip install` should be replaced with `uv pip install` for faster installs.

Suggests moving a Vitest project to the next notable speed milestone, one step at a time.

Suggests replacing sleep-based run-ID discovery after a workflow dispatch with the ID returned by the dispatch API.

Detects pushed BuildKit Docker image builds that do not request zstd layer compression.

Detects Pyramid `config.scan()` calls that do not specify an `ignore=` filter when the scan target contains directories that are unlikely to contain runtime application code.

The project has `norecursedirs` explicitly set in a pytest config file **and** does not have `testpaths` configured. The check also verifies that directories corresponding to pytest's default `norecursedirs` entries exist in the repository but are missing from the custom list.

The project uses pytest but has not configured `testpaths` in any pytest config file (`pytest.ini`, `pyproject.toml`, `setup.cfg`, `tox.ini`), and CI workflow steps do not pass explicit test paths either.

Detects CI pytest commands that run without parallel workers despite `pytest-xdist` being installed.

Detects heavy client, connection, or model initialization at module top level in `src/**/*.py` for FastAPI, Django, and Flask repositories.

Detects GitHub Actions jobs that initialize an ephemeral Rails test database by replaying all migrations with `rails db:migrate`, and recommends loading the schema directly instead.

Suggests evaluating a modern JavaScript test runner for repositories still on a legacy runner.

This rule detects repositories using webpack 5.x that could benefit from migrating to rspack.

This rule detects repositories using Babel that could benefit from migrating to SWC.

Version evidence prefers the root lockfile dependency. A manifest range must stay entirely below 4.47 to prove an older version when no lockfile version is available.

Version evidence prefers the root lockfile dependency. A manifest range must stay entirely below 5.53 to prove an older version when no lockfile version is available.

Flags repositories whose `.husky/*` hook files still use deprecated Husky bootstrap or x-runner wrapping such as `npx`.

Flags GitHub-hosted Ubuntu, Windows, or macOS jobs that visibly install a CLI already present on the runner image and then use that CLI later in the same job.

Respects job/workflow `cache-mode`: restore-disabled and unknown policies suppress overlap advice. Under `read`, a manual save-only step is not counted as duplicate work; manual restore can still overlap built-in restore.

Detects jobs that already install dependencies and still invoke common local CLI tools through bootstrap runners such as `npx`, `pnpx`, `pnpm dlx`, `bunx`, `yarn dlx`, `uvx`, or `uv tool run`.

Renovate configuration does not group AWS SDK dependencies, and the repository uses multiple AWS SDK v3 packages.

Renovate configuration does not group CDK dependencies, and the repository uses multiple CDK packages.

Renovate configuration does not explicitly set `rebaseWhen` locally.

Detects multiple non-matrix jobs within a workflow that share an identical bootstrap fingerprint (checkout + install + cache pattern).

Detects the same build family running in multiple non-matrix jobs within one workflow.

Detects the same install command running multiple times within one job.

Detects the same lint tool family running in multiple non-matrix jobs within one workflow.

Detects workflows that use `ruby/setup-ruby` but still run `bundle install` manually without enabling the official `bundler-cache: true` option.

Flags heavy scheduled workflows that appear to run more often than every 3 hours.

Detects `actions/setup-node` steps that enable caching without specifying `cache-dependency-path` when lock files exist outside the repository root.

Tailwind CSS content configuration must be present and scoped to avoid unnecessary file scanning.

GitHub App authentication via `app_auth` provides significantly higher API rate limits compared to a personal access token (PAT). Higher rate limits reduce the risk of hitting API limits during large `terraform plan`/`apply` operations, concurrent plans, and provider refreshes. Rate limit pauses can delay CI workflows by up to an hour.

**Severity**: suggestion **Confidence**: high

These resources already have an implicit repository scope via the GitHub provider. Looking up `data.github_repository` triggers an extra GitHub API call **per resource**, which inflates `terraform plan` and `apply` duration. In repositories with many branch protections, environments, or secrets, this compounds significantly and can trigger API rate limits.

Terraform root modules initialized in CI without their own `.terraform.lock.hcl`. Step/job/workflow working-directory defaults, static `cd`, and `terraform -chdir` are considered. A lockfile in another module does not suppress the finding.

Repositories that use `pagerduty_team_membership` with a PagerDuty provider version constraint that allows versions below v3.32.2.

Terraform defaults to `parallelism=10`, which is slow for large configurations. Tuning parallelism to match runner capacity is one of the highest-leverage Terraform CI optimizations.

Flags jobs that run `tox` without `tox-uv` installed.

This rule detects webpack configurations using `ts-loader` with `transpileOnly: true` or `happyPackMode: true` but missing `fork-ts-checker-webpack-plugin`.

Detects heavy jobs with no visible `if` condition inside broadly triggered workflows.

Detects jobs that install full application dependencies but only run lint or check tools.

Detects `actions/checkout` steps in jobs that only use artifact actions (`actions/download-artifact@` or `actions/upload-artifact@`) without any visible dependency on repository files.

Some workflows run `npm install -g npm` to upgrade the npm CLI before running `npm ci` or `npm install`. This is usually unnecessary — the npm version bundled with the runner's Node.js is sufficient for dependency installation. The global upgrade step adds wall-clock time to every CI run without improving reproducibility or correctness.

Jobs that use yarn, pnpm, or bun for package management but still run `npm install -g npm@latest` (or similar npm global upgrade commands).

Jobs that run inside a Docker container (`container:`) but install OS packages (`apt-get install`, `apk add`, `brew install`, etc.) in workflow steps where the installed packages are not referenced in later steps.