DEV Community: A.F.

I scanned 35 popular repos' GitHub Actions. Here's what's broken.

A.F. — Sun, 28 Jun 2026 05:59:20 +0000

The 2026 pricing changes got me curious how the projects I actually use run their CI. So I scanned 35 well-known open-source repos (vite, next.js, prisma, astro, eslint, the usual suspects) and pulled their public GitHub Actions data: recent runs, config patterns, failure rates.

A few things genuinely surprised me.

Some workflows have been failing nearly every run. And nobody turned them off.

The one I didn't expect: trpc has a scheduled workflow ("Lock Issues & PRs") that's failing nearly every run, and it's still on. Its own scorecard flags it outright: "failing almost every run." (see it: https://gitspider.com/scan/trpc/trpc)

It wasn't alone. drizzle-orm and cal.com each have a workflow stuck in the same red-forever state.

This isn't a knock on those teams (they ship great software). It's how universal the "set a scheduled workflow and never look at it again" pattern is. If projects this good have one that's been red for months, most of us do too.

Premium runners are the norm, not the exception.

20 of the 35 run at least some CI on macOS or Windows, which bill ~10x and ~2x a Linux minute. Free on public repos, but if you're private and on macOS, your bill is a different universe from the Linux-only projects.

Not one of the 35 had a clean config

Every single repo had at least one fixable finding. Most common across all 35:

missing job timeout: 33/35
no paths filters: 32/35
no concurrency cancel: 32/35
push + pull_request both running the full suite: 22/35

None of these are hard to fix. They're just spread across dozens of workflow files, so nobody ever sits down and does it.

Reliability varies more than I'd have guessed

Failure rates ran from near-zero up to about a third of recent runs: solid ~34%, trpc ~32%, drizzle ~23%. Some is flaky tests, some is those always-red workflows dragging the average.

Caveats so this is honest: these are public repos, so Actions is free for them. The dollar figures (on the scorecards) are "what it would cost at paid rates," not their bill. And the scanner samples recent runs (capped at 500), so the counts are a sample, not a 30-day total.

I built the scanner (it's free, no install for public repos). The scorecards are here: https://gitspider.com/showcase?ref=devto , and you can scan your own at https://gitspider.com/scan?ref=devto . Honestly the most useful thing is just checking your own repo for that one workflow that's been red for months.