CI Diet

CI Diet

English · 한국어 · 简体中文 · हिन्दी · Español · Français

Find GitHub Actions jobs that run longer or more often than they need to. Review small YAML fixes before applying them.

CI Diet is an alpha CLI and DeepSeek Harness (DSH) plugin. It reads workflow definitions and, when enabled, GitHub Actions history; then it shows findings and prepares narrow YAML edits without changing a workflow on its own.

Install

The CLI requires Node ^22.19.0 || >=24.0.0. This is the current npm release, 0.5.2.

npm install --global dsh-ci-diet@0.5.2
ci-diet --version
dsh plugin --profile web add dsh-ci-diet@0.5.2
dsh --profile web

The plugin registers DSH tools plus the Settings → CI Diet and CI Diet review screens. Installation alone does not scan a repository, save runner minutes, or modify a workflow. If you skip the global CLI install, use npx dsh-ci-diet@0.5.2 in place of ci-diet.

First scan and history

Run these commands from the repository you want to inspect. The static scan is offline and saves its report. History sync is a separate network step that reads recent runs and jobs through the authenticated gh CLI using read-only GitHub API requests.

ci-diet scan --cwd .
gh auth status
ci-diet sync --cwd . --network
ci-diet report --cwd .
ci-diet report --cwd . --format html --out report.html

gh needs read access to the repository's Actions runs and jobs. CI Diet never needs GitHub write access. The HTML report is one self-contained file with inline CSS, no scripts, and no external requests. In DSH, ci_diet_scan and ci_diet_sync both save reports; network access and preflight are on by default for new plugin profiles.

What it finds

CD003 and CD005 are disabled by default. CD002, CD003, and CD004 do not produce patches. CD005 caps abnormal runs; it does not shorten normal execution. CD008 changes artifact storage retention, not runner minutes. Every plan remains a hypothesis until you review it and measure the result.

Supported npm cache example

CD006 recognizes a narrow shape: a supported actions/setup-node@v7 step followed by npm ci, with a tracked manifest and lockfile. The plan adds cache inputs only; versions, installation, and tests stay in place. The example assumes package.json does not declare npm in either packageManager or devEngines.packageManager; v7 enables caching automatically when npm is declared, so CI Diet does not propose a redundant cache.

Before

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v7
        with:
          node-version: 22
      - run: npm ci

After

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v7
        with:
          node-version: 22
          cache: npm
          cache-dependency-path: package-lock.json
      - run: npm ci

For a plan command, --step 1 means the second step in this YAML array: checkout is step 0, setup-node is step 1. It is a zero-based index, not a step label. See the plugin guide for pnpm, Bun, timeouts, retention, and current guards.

Review before write

The workflow is scan → preview → human approval → apply → measure. The model tools, including ci_diet_plan, preview edits and compute a plan digest; they cannot approve, apply, or revert. The review screen can approve, apply, and revert after a person types the plan digest suffix or change ID. Local writes are byte-range edits to one existing workflow file.

ci-diet plan --cwd . --rule CD006 --workflow .github/workflows/ci.yml --job test --step 1
ci-diet plans --cwd . --plan PLAN_ID
ci-diet approve --cwd . --plan PLAN_ID --confirm CONFIRMATION
ci-diet apply --cwd . --plan PLAN_ID
ci-diet measure --cwd . --change CHANGE_ID --before-runs 100,101 --after-runs 110,111 --network
ci-diet revert --cwd . --change CHANGE_ID

Approval authorizes only that plan. Apply creates a backup, rewrites the planned bytes, and performs source, dependency, policy, digest, lock, and backup checks. Revert restores the backup. CI Diet does not commit, push, deploy, run a workflow, change branch protection, or delete artifacts.

Measurement and limits

• No savings are claimed before measurement. A finding can be wrong when history or workflow attribution is incomplete.
• A dependency cache can add restore/save time. Its overhead can exceed the installation time it avoids; compare compatible cold and warm runs and include cache steps.
• measure compares selected real runs and reports observed runner-time differences, success and rerun rates. The comparison covers those samples only; it does not establish the cause of a change or reproduce your bill.
• The Settings page stores tool configuration and shows session-scoped reports and plans. It does not optimize a workflow by itself.
• Source hashes, approval expiry, and policy checks can block an edit. Review the report, the diff, and the repository's own checks before keeping a change.

Keeping these values separate prevents modeled minutes from becoming a billing claim.

Documentation

New DSH profiles enable preflightEnabled, networkEnabled, localApplyEnabled, and rules CD001, CD002, CD004, CD006, and CD008. The one-time migration records defaultsRevision: 2; later switch and rule choices survive restarts. CD003 and CD005 stay off until explicitly enabled. State paths, retention, quotas, and existing billing inputs are preserved.

The plugin targets DSH >=0.2.1-rc.2 <0.3.0-0 and >=0.2.2-rc.1 <0.3.0-0. DSH 0.3.0 is not supported. Plugin preflight checks supported deployment commands before they run, but it makes no network request or file change and skips opaque shells. CLI history requires --network; the plugin network switch permits gh calls only when the sync tool is invoked. Update with the same commands and @latest, then restart DSH.

Contributing and license

Bug reports and focused proposals are welcome in GitHub Issues. For rule or contract changes, read the guide and decisions first. Detailed specifications and public documentation are English.

MIT © Rodisoft